fix(json): JSON.parse reviver on a lazy-tape array no longer SIGSEGVs (#1424)

[proggeramlug]

Summary

JSON.parse(blob, reviver) on a large top-level array crashed with SIGSEGV (exit 139, zero output) under the lazy-tape path (PERRY_JSON_TAPE=1, and the default for this shape), and the reviver was never invoked on the elements (#1424).

apply_reviver walks the parsed value as an ArrayHeader, reading length/capacity/element f64s directly off the pointer. A LazyArrayHeader has a different layout, so those reads returned garbage → out-of-bounds element access → crash. Fix: materialize a lazy array via force_materialize_lazy at the top of apply_reviver (mirroring the stringify path's redirect_lazy_to_materialized, but forcing materialization since nothing has indexed the array yet), so the in-place element walk + write-backs operate on a real ArrayHeader and the caller receives the materialized array.

Test

Flips test_json_lazy_reviver to PASS in both default and PERRY_JSON_TAPE=1 modes:

len 300
first 1
last 300
calls 301

JSON parity sweep clean in the default (CI) config: 18 pass, 0 fail.

Note: a separate, pre-existing tape-only bug remains — console.log() of a non-revived lazy string array prints [object Object] (test_json_sso_strings under PERRY_JSON_TAPE=1); unrelated to the reviver path. Filing separately.

Closes #1424.