fix(runtime): built-ins/Function test262 parity (instanceof Function, fn.constructor, Function.prototype length/name)

[proggeramlug]

Summary

Drives built-ins/Function test262 parity from 285→300 (+15), 62.4%→65.6%, with zero regressions.

The headline fix is cross-cutting: value instanceof Function was returning false for every callable. That single gap blocked a large swath of the Function suite (which constructs functions and then asserts f instanceof Function) and also showed up under language/expressions/instanceof, built-ins/AsyncFunction, Promise, and Array.

Root causes fixed

1. x instanceof Function always false. No callable representation was recognized — function declarations, expressions, arrows, methods, bound functions, native handles, and built-in constructors all returned false.

   • Added a reserved class id CLASS_ID_FUNCTION = 0xFFFF00F0 emitted by the instanceof operator (perry-codegen) and resolved in the runtime (js_instanceof / js_instanceof_dynamic) through a new value_is_callable predicate (callability test, not a prototype-chain walk).

2. fn.constructor returned undefined for ordinary functions. Now resolves to the global Function. Generator / async-generator functions keep their existing intrinsic constructors.

3. Function.prototype lacked its own length (0) and name ("") data properties. Installed both with spec attributes { writable: false, enumerable: false, configurable: true }, ordered so length precedes name in getOwnPropertyNames (built-in property order). Fixes prototype/length.js, prototype/name.js, prototype/property-order.js.

Before → after

suite	before	after
built-ins/Function	285 / 457 (62.4%)	300 / 457 (65.6%)

Files

• crates/perry-codegen/src/expr/instance_misc1.rs
• crates/perry-runtime/src/object/instanceof.rs
• crates/perry-runtime/src/object/field_get_set.rs
• crates/perry-runtime/src/object/global_this.rs

Zero-regression note

Ran the built-ins+language shard 0/12 on this branch vs an origin/main baseline built from the same corpus: 1601→1607 pass. The only set-difference failure (built-ins/MapIteratorPrototype/next/length.js) reproduces identically on both builds when run in isolation (flaky contention timeout in the parallel runner, not a behavior change). FIXED set on the broad shard includes language/expressions/instanceof/S11.8.6_A7_T3.js, built-ins/AsyncFunction/AsyncFunction.js, built-ins/Promise/prototype/then/..., and built-ins/Array/prototype/reduce/....

Out of scope (follow-ups)

Remaining Function failures cluster around larger work: runtime ToString-coercing dynamic Function(objArg, …) construction, always-strict-mode this (sloppy-mode this→global tests), class toString source reconstruction + class accessor descriptor reflection, and CJS top-level this harness artifacts.