Make String.prototype.matchAll return a lazy iterator

[frostney]

Summary

RegExp support landed in #172, but String.prototype.matchAll() still materializes all matches eagerly into an array-backed iterator.

Current behavior

• all matches are collected up front
• the returned iterator is backed by a precomputed array of match results
• this diverges from the spec-style lazy iteration model

Scope

• make matchAll() advance lazily as the iterator is consumed
• keep behavior consistent across interpreted and bytecode execution
• add coverage for iterator consumption order and partial consumption semantics
• document any remaining deviations from ECMAScript behavior

Follow-up from #172.