fix: substring() swaps args when start > end per js spec

[cs01]

Summary

• "ABCDE".substring(3, 1) now correctly returns "BC" instead of empty string
• Per JS spec, substring() should swap start/end when start > end, and clamp negatives to 0
• Previously, negative length from end - start when start > end caused empty/wrong results

Test plan

• New test fixture string-substring-swap.ts covers swapped args, equal args, single arg
• npm run verify:quick passes (tests + Stage 1 self-hosting)

🤖 Generated with Claude Code