Fix #708, #574, #565: boxed-primitive wrapper coercion

[nickna]

Part of the Batch-1 "boxed-primitive value semantics" cluster. Ships three tightly-coupled, regression-free fixes; the two remaining Batch-1 issues (#475, #449/#474) are split off (see below).

Fixes

• Interpreter: new Number(x) / new String(x) wrapper objects don't coerce (valueOf returns the object; String.fromCharCode(new Number(1)) crashes) #708 — new Number/String/Boolean wrappers now coerce to their primitive. Registered valueOf/toString on the Number and String built-ins, and added an interpreter ToPrimitive (OrdinaryToPrimitive, honoring an own valueOf/toString) wired into +, arithmetic/comparison/bitwise (via CoerceToNumber), loose ==, template literals, and String.fromCharCode/fromCodePoint. A wrapper now reduces to its [[PrimitiveValue]] instead of "[object Object]"/NaN, and String.fromCharCode(new Number(1)) no longer hard-crashes.
• Boxed primitive wrappers ignore a user-overridden valueOf/toString in ToNumber/ToString (e.g. JSON.stringify) #574 — JSON.stringify honors a user-overridden valueOf/toString on a wrapper (Number→ToNumber, String→ToString through ToPrimitive; Boolean→the [[BooleanData]] slot). Both the value and space unwrap route through the interpreter.
• Compiled JSON.stringify unwraps a plain object that has a __primitiveValue field (boxed-primitive check too loose) #565 — compiled JSON.stringify gates the boxed-primitive unwrap on a string __primitiveType tag, matching the interpreter, so a plain object that merely has a __primitiveValue field is no longer unwrapped.

Verification

• Full suite green: 13,419 / 13,419.
• Test262 interpreted baseline: 29 new passes (committed surgically, isolated by regenerating interpreted.txt on main vs this branch — only those lines changed): JSON value/space-{number,string}-object, String fromCharCode/fromCodePoint/concat/toString/valueOf, Number valueOf, new-expression wrapper coercion (S11.2.2), and Array.prototype.*.call over a number/boolean primitive. No Pass→Fail regressions. (fromCharCode/S9.7_A3.1_T4 moves RuntimeError→Fail: an object-with-valueOf arg, still unsupported but no longer crashing.) Compiled baseline unchanged (Compiled JSON.stringify unwraps a plain object that has a __primitiveValue field (boxed-primitive check too loose) #565 has no Test262 case).

Deferred (kept open)

• Boxed primitive wrappers leak __primitiveType/__primitiveValue into enumeration; interp Object.keys ignores enumerability #475 (Object.keys/values/entries enumerability) — implemented and working, but respecting enumerability exposed two pre-existing gaps it would regress on: for-in doesn't filter internal slots, and Object.defineProperty resets an existing property's enumerable flag when redefining with a partial descriptor. Needs those companion fixes; pulled out to keep this PR clean.
• compiled: bare symbol Symbol() instanceof Symbol returns true (should be false); boxed Object(sym) instanceof Symbol returns false (should be true) #449 / interp: Array.prototype.*.call(<number/boolean primitive>) — primitive prototypes aren't mutable and boxed wrappers don't read array-like state through the prototype chain #474 (Symbol instanceof; mutable primitive prototypes) — separate sub-areas (Symbol-global plumbing + Object(sym) boxing; prototype mutability), to be tackled next.