Support plain object inputs and stored callbacks in TS calls

[CaelmBleidd]

Summary

• Execute callbacks stored in TypeScript object fields through the associated-function path, including fields declared in a superclass. Ordinary function expressions receive the call receiver as this.
• Support recursive plain-object fields and fields containing boolean/number arrays in Calls symbolic inputs, model extraction, and exact TypeScript source replay.
• Reject nested object domains with unresolved or incompatible EtsIR field types during preflight as INPUT_DOMAIN_UNSUPPORTED.
• Snapshot coverage replay inputs before invoking a function that may mutate its object argument.

Scope

Object fields support boolean, number, string, nested ObjectDomain, and ArrayDomain with boolean/number elements. Arrays of objects and lexical this for stored arrow functions remain open; #419 has failing test examples and acceptance criteria.

Class-instance construction for external arguments, reference aliases, class-wide coverage denominators, and method scheduling remain explicit gates for the class-coverage experiment.

Evidence

• After the review fixes in 94f55e19: 48 CurrentTsCallsSymbolicEngineTest tests and 4 StoredFunctionCallTest tests passed.
• :usvm-ts:detektMain, :usvm-ts:detektTest, :usvm-ts-calls:detektMain, :usvm-ts-calls:detektTest, and git diff --check succeeded. The Calls Detekt tasks still report unrelated existing warnings.
• The initial PR revision passed npm test in usvm-ts-fast-check/fast-check-adapter (80 tests) and ./gradlew :usvm-ts-pbt:test :usvm-ts-calls:test :usvm-ts:test.

Base: caelmbleidd/iccq-coverage-yices at 5736a5b3664f045c0e5c15c71c832a63be0cddcc.