instanceof against a specific sibling evaluation as RHS still collapses to class_id (js_instanceof_dynamic's is_class_object_value branch, not covered by #10624's fix)

[proggeramlug]

Found while fixing #10624 (PR #10640), which made instanceof's class-chain walk consult each evaluation's pinned
heritage instead of the shared template class_id. This is the sibling case that fix does not reach.

Shape: instanceof against a specific sibling evaluation referenced directly as the RHS. Given two
evaluations A and B of the same class factory — which share a template class_id — x instanceof A still
collapses to a class_id comparison and cannot distinguish A from B.

This lives in a different code path from the one #10640 fixed: js_instanceof_dynamic's
is_class_object_value branch, rather than class_chain_reaches. It is pre-existing on baseline, not introduced
by that PR.

The mechanism to follow is already in place: PR #10640 added pin_instance_constructing_class /
instance_pinned_constructing_class in class_registry/evaluation_heritage.rs, and a value-aware walk
(class_chain_reaches_dynamic) that prefers a pinned VALUE at each hop before falling back to template
resolution. The same preference needs applying on the direct-RHS branch.

Note the file-size constraint: crates/perry-runtime/src/object/instanceof.rs is at 1998 of the 2000-line
cap after #10640. scripts/check_file_size.sh is a lint gate, so this fix will need a split first — #10640
already extracted subclass_of_builtin_reaches for an unrelated reason and is a template for how to do it.