Runtime: reject BigInt primitives as constructor prototype objects

[chrisbbreuer]

Parent #465; related #823. Reproduced on pushed e24c4fa: function NewTarget() {}; NewTarget.prototype = 1n; Object.getPrototypeOf(Reflect.construct(TypeError, [], NewTarget)) !== TypeError.prototype. Node 24.18.0 passes the correct identity assertion; the local forced-tier witness fails in the tree walker. ctorRealmIntrinsicProto rejects the internal Symbol representation but accepts the internal BigInt cell as a JavaScript Object. GetPrototypeFromConstructor must distinguish ECMAScript objects from all internal primitive cells and select the exact newTarget realm intrinsic for primitive prototypes. Audit related prototype selectors, preserve one observable prototype get and abrupt completion, and add bound/proxy/cross-realm and forced-tier regression coverage. No mutable-name fallback or coercion workaround.

[chrisbbreuer]

Expanded baseline is recorded: 90/90 reference probes pass in Node 24.18.0; the engine passes 28/90 in automatic mode and 28/90 forced tree/bytecode pairs. Coverage includes 28 constructor families with primitive BigInt prototypes, boxed-BigInt positive controls and foreign NewTarget realms, three dynamic function kinds, ordinary construction, one observable prototype get, and revocation during that get. No #825 implementation has been mixed into the #823/#824/#826 changes. The remaining work is constructor-prototype selection and exact realm fallback, not coercion of BigInt into an object.