String-key `in` on typed arrays/Buffers misses prototype members (order-dependent)

[proggeramlug]

Summary

<method-name> in <typed array or Buffer> returns false for inherited
%TypedArray%.prototype members, and "length" in <typed array> can too —
inconsistent and order-dependent.

Repro

const i16 = new Int16Array([1,2,3]);
console.log("subarray" in i16); // node: true;  perry: order-dependent
const u8 = new Uint8Array([1,2,3]);
console.log("subarray" in u8);  // node: true;  perry: false
console.log("length" in new Int32Array(0)); // node: true;  perry: false

Notes

Follow-up to #6148 / PR #6163 (which fixed numeric-index in on
Uint8Array/Buffer). String-key in for inherited typed-array prototype members
depends on the shared %TypedArray%.prototype intrinsic, which is populated
lazily (first registered typed-array creation) — so results vary with order,
and buffer-backed Uint8Array misses it entirely. A robust fix should resolve TA
prototype membership without relying on lazy intrinsic state, for both the
registered typed-array arm and the buffer arm in js_object_has_property.
Buffer-specific methods (readUInt8, write, …) on Buffer.prototype are part
of the same gap.