fix(codegen): root the Set receiver across the value in SetHas/SetDelete; return js_map_set's receiver (#9523) - #9532

Closes #9523.

What was wrong

Expr::SetHas / Expr::SetDelete (expr/bigint_set.rs) lowered the receiver, masked it to a raw i64 handle, then lowered the value expression, then consumed the handle — the #6970 shape MapGet / MapHas / MapDelete were fixed for, found live in these two twins by #9522's audit.

Why it is live rather than already covered by root_reload. For a function-local Set the receiver is a shadow-slot load, and root_reload.rs re-materialises that load and its bitcast/and unmask below every collection point that reaches a use, so that shape is correct on main. A module-level Set is a @perry_global_* load, which root_reload deliberately does not reload ("that population needs rooting, not reloading"). So seen.has(makeKey()) on a module-level Set hands js_set_has a from-space pointer as soon as makeKey drives an evacuating minor.

Measured on unfixed main (perrymaster, x86-64, default knobs): test_gap_9523_set_receiver_roots_across_value.ts SIGSEGVs where node prints set-receiver bad=0. The runtime's own from-space quarantine names it (PERRY_GC_PROTECT_FROMSPACE=1, diagnostic only):

[gc-fromspace-protect] FAULT: signal 11 at 0x4bac0620350
  This address is RETIRED FROM-SPACE. The evacuating minor moved or
  freed the object here and the holder kept the pre-collection address.
  retired_by_minor=#0
  last-known object: user_ptr=0x4bac0620358 obj_type=12 size=40

obj_type=12 is GC_TYPE_SET: the retired object at the fault address was the Set receiver, moved by the first minor of the value's churn. A has-only reduction faults immediately after printing before has 0; fixed, it prints has=true three times under the same protector.

Fix

Mirror the Map twins. Both arms now open a RootedGroup, lower the receiver as its one operand with collects = operand_may_collect(value), lower the value in whichever native representation the arm selects, and only then re-read the receiver from its slot and unbox it (reread_set_receiver, the reread_map_set_receiver_and_key shape). When the value cannot collect the group pushes nothing, the eager unbox is kept, and the emitted IR is byte-for-byte what it was. bigint_set.rs joins the MIGRATED_MODULES ledger — it names only crate::rooting.

Second item, same file family. lower_call/property_get/map_set.rs's "set" arm (the this.field.set(k, v) path) called js_map_set as void and returned the receiver box read from its slot before the call. js_map_set returns the receiver as it stands after the insert: for a class X extends Map instance the runtime roots the movable ObjectHeader across the grow and returns the relocated address (map_op_returning_receiver). The arm now re-boxes the returned pointer, as Expr::MapSet already does, so a chained .set(a, 1).set(b, 2) consumes a current address.

Verification

• Deterministic, no-knob gap fixture test-files/test_gap_9523_set_receiver_roots_across_value.ts: module-level Set<string> / Set<number> / Set<any> receivers (string, guarded-number and generic arms), has and delete, a 400k-cell escaping churn in the value position (the cc auth-error path: Cannot read properties of undefined (reading 'def') where node reports Not logged in #9417 nursery-escape recipe), plus a non-collecting control. Unfixed main: SIGSEGV on every run. Fixed: byte-identical to node, rc 0. The fixture header documents the two load-bearing properties (module-level receiver; escaping churn past the 16 MiB nursery cap).
• test-files/test_gap_9523_map_set_chain_returns_receiver.ts: chained .set().set() through a Map<string, number>-declared field holding a Map subclass, growth on the first insert, 24 rounds of swept nursery fill, plus the set(...) === this.m identity contract. This staleness is latent, as the issue says — the minor has to fire inside the first set's grow — and the fixture passes on unfixed main too; it pins the contract and is byte-identical to node.
• Codegen coverage temp_root_coverage/set_receiver.rs (in src/, so it runs in the per-PR cargo-test gate), each test under both root lowerings: has / delete receiver rooted across an allocating value (names the js_set_alloc value and the slot re-read via assert_rooted_across); a non-collecting value pays no temp slot; the typed string arm pays exactly one temp slot with a collecting value and none with a literal. 4/4 green.
• Sabotage: reverting only bigint_set.rs to main with the tests kept fails 3 of 4 on the named assertions — has/delete: "%r1 is never stored into a rooted slot — it lives its whole life in an SSA register"; typed arm: left: 0, right: 1 temp slots — while the non-collecting gate stays green (it cannot distinguish, by design). Restored, 4/4.
• migration_ledger 6/6 green; perry-codegen lib: 1394 passed / 0 failed (1 ignored); parity slices (_set, map, 9417, 6970, collection): _set 58 pass / 2 fail, map 56 / 1, 9417 4 / 0, collection 10 / 0 — the three failures are test_gap_2514_settracesigint, test_phase2v3_3_show_toast_set_text and test_effect_pipe_map, all pre-existing entries in test-parity/known_failures.json (SIGINT, UI compile error, missing effect package on the oracle host); nothing Set/Map-related moved.