feat: support full JavaScript in Isogloss

[owengregson]

Summary

• accept the complete modern JavaScript grammar in the Isogloss source architecture
• lower only finite, proven-pure return relations into BPRF while preserving all other behavior in native Isogloss regions
• report native, BPRF, and hybrid coverage through diagnostics, build statistics, CLI output, docs, and the web UI
• preserve dynamic JavaScript semantics around eval, Function, with, observable coercion, intrinsic shadowing, async/generators, private classes, modules, TypeScript, and JSX
• add a reproducible nine-workload architecture benchmark against frozen pre-PR-6 VM commit e8cecb56ba89d47512a16e325d81cf46f64b2ecb

Why

PR 7's source path rejected configured functions when calls, effects, unsupported coercions, unsafe numeric ranges, or other non-provable expressions appeared. That made BPRF proof limits a JavaScript compatibility boundary.

This change separates compatibility from protection. Every valid JavaScript construct remains executable in a native lane; eligible bounded expressions are replaced with BPRF realizations; functions containing both are reported as hybrid. A missing configured target still fails closed so misspellings do not silently bypass selection.

Native regions remain observable JavaScript. Full-language support is intentionally not presented as whole-language protection, and only protectedRegionCount represents BPRF replacement.

Benchmark

Full measurements and environment metadata are checked in under docs/superpowers/baselines/2026-07-25-pr8-isogloss-vs-legacy-vm.{md,json}.

• Isogloss: 9/9 workloads correct; legacy VM: 7/9 supported
• median build: 0.227 ms Isogloss vs 2.396 / 3.838 / 13.973 ms legacy default / medium / max
• geometric runtime overhead vs native: 2.57x Isogloss vs 38.84x / 36.93x / 95.32x legacy
• common-workload output: 26,377 bytes Isogloss vs 96,834 / 127,661 / 335,889 bytes legacy
• verified package output: 172,080 bytes total, 69.8% below the frozen VM package build

The speed and size comparison is not a claim of equal protection: seven current workloads are intentionally native compatibility regions.

Verification

• cd packages/ruam && bun run prepublishOnly — typecheck, 205 tests, and package build
• cd packages/ruam && bun run build:browser
• cd apps/web && bun run typecheck && bun run build
• cd packages/ruam && bun run bench:architectures
• git diff --check

This PR is stacked on PR 7 (codex/pr6-performance-security-hardening).