Dynamic __proto__ assignment creates an own property instead of invoking the prototype setter

[proggeramlug]

Found during #6812 builder-fold semantic testing (pre-existing — reproduces identically on pre-fold builds back to at least the #6808-era main).

const protoSrc = { tag: "P" };
const o: any = {};
o.__proto__ = protoSrc;   // dynamic member assignment, not literal syntax
console.log(o.tag, Object.getPrototypeOf(o) === protoSrc, Object.keys(o).join(","));

• node: P true "" — the assignment invokes the inherited Object.prototype.__proto__ setter, changing [[Prototype]]; no own property is created.
• perry: undefined false "__proto__" — the dynamic member-set path creates an ordinary own enumerable property named __proto__.

(Object-LITERAL __proto__: syntax is a separate, already-handled path; this is only the assignment form.) Expected fix location: the dynamic member-set entry (js_put_value_set / js_object_set_field_by_name key special-case, mirroring the literal handling and Object.setPrototypeOf routing incl. the null/undefined-ignore and non-object-value-ignore spec rules).

Note: the #6812 builder-fold pass deliberately refuses to fold __proto__ keys, so it neither depends on nor masks this.