fix(hir): honor lexical fetch bindings

[proggeramlug]

Closes #10887

Stacked on #10886 because that change is required to reach this node-fetch failure.

Root cause

HIR lowering treated every bare call spelled fetch(...) as the global Web Fetch API, even when a lexical import or local binding shadowed the global. node-fetch is conventionally imported as fetch, so its userland Response was incorrectly tagged as a native response; response.text() was then routed to native response-handle FFI and rejected with Invalid response handle.

Fix

• classify bare fetch(...) as native only when the unqualified global is not shadowed
• retain the existing explicit fetchWithAuth / fetchPostWithAuth wrapper convention
• add a HIR regression test for a lexical fetch returning a userland response

Validation

• cargo test -p perry-hir a_lexical_fetch_result_is_not_registered_as_a_native_response --lib
• python3 scripts/check_test_registration.py
• git diff --check
• real node-fetch@3.3.2 public-entry fixture no longer throws Invalid response handle; it advances to the independently tracked derived-constructor failure in Derived class that calls super() then returns a Proxy trips "Must call super constructor" — blocks node-fetch after #10759 #10809

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 17111fa2-36e8-430d-b1f0-574f62b0d770

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[proggeramlug]

Landed via merge train 253 (#10918) as v0.5.1633 — merge commit 0fa3915293.

Expedited at the owner's request. Carried with nine other PRs; the stacked ones (#10899/#10900 on #10886, #10901 on #10885) had only their unique commits taken.

Evidence on the assembled tree: perry-runtime full suite 4233 passed / 0 failed / 0 SIGABRT, perry-hir 471 / 0, cargo check --workspace --all-targets under -D warnings clean, cargo fmt --check clean, and all eight ratchets rc=0. The gap sweep and compiler-output suites were not run.

Closing here rather than merging — a train lands the commits directly.