fix(runtime): an Array subclass in a base-typed binding was read as a raw header (#7574) (#7603)

An Array-subclass instance is a plain ObjectHeader that overlays ArrayHeader field-for-field, so a.push(1) stored 1.0 over keys_array (a live GC child edge) and the second push SIGSEGVed dereferencing it -- fault address 0x3ff0000000000000, the bit pattern of the double just written. Brand checks at the runtime funnels plus two codegen tiers the issue did not name (the inline ArrayPush store -- the actual crash -- and the typed-feedback boxed fallback); subclass receivers redirect onto the spec-generic engine. Includes the forEach receiver, the Array-exotic length step on the unannotated path, and a concat regression the funnel itself introduced, caught by the family A/B.

Author: proggeramlug

CLAUDE.md

@@ -8,7 +8,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 
 Perry is a native TypeScript compiler written in Rust that compiles TypeScript source code directly to native executables. It uses SWC for TypeScript parsing and LLVM for code generation.
 
-**Current Version:** 0.5.1342
+**Current Version:** 0.5.1343
 
 
 ## TypeScript Parity Status