Built-in property descriptors & .name/.length conformance (Test262 verifyProperty)

[proggeramlug]

Summary

Built-in functions/methods/constructors don't expose spec-correct own-property descriptors, which is the single biggest gate on Test262 conformance (built-ins/*). Test262's verifyProperty (used in thousands of cases, via harness/propertyHelper.js) checks the full descriptor of every built-in method/property: value, writable, enumerable, configurable, plus the method's own .name/.length. A case only passes when all facets match.

Partial progress already landed: PR #2554 made built-in prototype methods enumerable:false. This issue covers the remaining descriptor facets.

Concrete gaps (Perry vs Node --experimental-strip-types)

// 1. Built-in constructor .length (and .name on reified values)
Array.name      // Perry "Array" ✓ (folded, #2144)   — but:
Array.length    // Perry 0        ✗   Node 1
Object.length   // Perry 0        ✗   Node 1

// 2. .name / .length on a method read as a VALUE (not the #2144 syntactic fold)
var m = [].map;
m.name          // Perry: CRASHES "Cannot read properties of undefined (reading 'name')"   Node "map"
m.length        // Node 1
Array.prototype.map.name    // Node "map"   (works via #2144 only for the exact syntactic form)

// 3. writable / configurable ENFORCEMENT (verifyProperty actively tests these)
//    - writing to a non-writable builtin prop must no-op (sloppy) / throw (strict)
//    - delete of a configurable builtin prop must succeed and remove it
//    - Object.getOwnPropertyDescriptor(Array.prototype.map, "name")
//        Perry {value:"map", writable:TRUE,  enumerable:false, configurable:true}
//        Node  {value:"map", writable:FALSE, enumerable:false, configurable:true}

.name/.length on a built-in method must be { writable:false, enumerable:false, configurable:true }; on a built-in method object itself the proto-method is { writable:true, enumerable:false, configurable:true } (done in #2554).

Where the code lives (as of current main)

• crates/perry-runtime/src/object/global_this.rs — install_proto_method / populate_builtin_prototype_methods (single install point for all builtin proto methods) and the constructor singletons in populate_global_this_builtins.
• crates/perry-runtime/src/object/mod.rs — PropertyAttrs, the PROPERTY_DESCRIPTORS side table, the GLOBAL_DESCRIPTORS_IN_USE hot-path gate, and the no-gate helpers set_builtin_property_attrs (added in fix(runtime): built-in prototype methods are non-enumerable (spec descriptor) #2554) and set_builtin_accessor_descriptor (bug: built-in function .name own-property returns undefined (function foo(){}; foo.name === undefined) #2060).
• crates/perry-hir/src/lower/expr_member.rs — the existing #2144 .name syntactic fold (extend to .length, and make value-reads work via the runtime, not just the fold).

Recommended approach

• Reuse the no-gate set_builtin_property_attrs pattern (PR fix(runtime): built-in prototype methods are non-enumerable (spec descriptor) #2554 / bug: built-in function .name own-property returns undefined (function foo(){}; foo.name === undefined) #2060): Object.getOwnPropertyDescriptor, Object.keys, for-in read PROPERTY_DESCRIPTORS per-object unconditionally, so builtin descriptors can be registered without flipping GLOBAL_DESCRIPTORS_IN_USE (no hot-path perf cost — important).
• Give every installed builtin method/ctor a real .name/.length own-property (these are themselves data-properties with {writable:false, enumerable:false, configurable:true}) so the reified value (var m=[].map; m.name) resolves instead of crashing — coordinate with the method-reification work (separate issue).
• Enforce writable:false/configurable in the write/delete paths (field_set_by_name.rs, the delete path) for builtin-descriptor'd keys.

Acceptance criteria

• Array.length===1, Object.length===1, etc.; [].map.name==="map", [].map.length===1 (no crash).
• Object.getOwnPropertyDescriptor(Array.prototype.map, "name") === {value:"map", writable:false, enumerable:false, configurable:true}.
• verifyProperty(Array.prototype, "map", {writable:true, enumerable:false, configurable:true}) passes; same for representative String/Number/TypedArray methods.
• No regression to user-object descriptors or the object get/set hot path (don't flip the global gate).
• Measure with scripts/test262_subset.py --dir built-ins/Array built-ins/String built-ins/Number --max 300.

Refs: Test262 radar #799, Node+TS roadmap #793. Pattern PRs: #2554, #2060, #2144.