fix(es5): bound-function prototype walk (#4563) + own length seed (#4562)

[ttraenkler]

ES5 standalone: bound-function prototype walk + length seed

Follow-up to #4658. Two fixes that had to land in this order, plus the
measurement showing why.

#4563 — a callable carrier's expando bag shadowed its prototype walk

var b = foo.bind({});
Object.defineProperty(b, "zz", { value: 1, configurable: true });
Function.prototype.property = 12;
b.property;   // was undefined — want 12

Defining any own property on a bound function stopped it inheriting from
Function.prototype: the $__bound_fn carrier's expando bag (#4241) shadowed
the prototype walk once non-empty, answering undefined on a bag miss instead of
continuing up the chain. Pre-existing, and a plain-JS idiom broken outright.

#4562 — seed a bound function's own length (§20.2.3.2 steps 5-8)

built-ins/Function/prototype/bind: 73/100 → 75/100, target=standalone.
Zero regressions — set difference in both directions gives 2 fixed
(instance-length-prop-desc, instance-length-remaining-args), 0 broken.

The ordering is the point. An earlier cut of this seed measured +2 / −2
and was reverted rather than shipped as a wash: giving every bound function
an own property drove them all into the #4563 state, so 15.3.4.5-11-1 /
15.3.4.5-6-2 (a bound function must inherit from Function.prototype) broke as
fast as the length rows were fixed. With #4563 landed first, the trade is gone
and both shapes pass together.

The value is computed at runtime, because §20.2.3.2 reads length off the
target — an arbitrary runtime value that defineProperty can change between
declaration and bind, and the target may itself be bound. Only the argument
count is static.

Budget gates: earned first, granted at the floor

• LOC on calls.ts went +9 → +2 by moving the local plumbing into the new
  subsystem module behind seedBoundFunctionLengthOnStack. The remaining +2 is
  one import and one call — the floor — and is granted on fix(#4454): register __make_getter_callback for spread+method object literals on the host plain-object path #4562.
• The func-budget entry sits on fix(codegen): match-vec structurally excluded from closed-struct array-like arms (#4443) #4563, where the growth actually came from
  (fillClosurePropHelpers), not on the issue that happened to trip it.

Provenance

The #4562 implementation was recovered uncommitted from a lane that hit its
usage limit mid-task — a 161-line module plus a two-line hook that existed only
in a worktree. Rescued, re-based onto current main, re-measured, and landed.

Corpus status

The 523-row ES5 standalone residue corpus reads 120 converted on current
main (up from 109 at #4658, as main advanced). The two bind rows above sit
outside that ES5-classified denominator, so they are a real gain that this
particular number does not move.

🤖 Generated with Claude Code

https://claude.ai/code/session_015vAL9KZvTPwwBcFovPJ8aH