[TS] Bind lexical this when calling stored arrow functions #440

Problem

A stored arrow function is called with the receiver of the property access instead of the this captured where the arrow was created. This is independent of the object-array symbolic-input problem that remains in #419.

Minimal TypeScript example

class Box {
  callback!: (value: number) => number;

  constructor(public offset: number) {}

  installOn(target: Box): void {
    target.callback = (value: number) => this.offset + value;
  }

  call(value: number): number {
    return this.callback(value);
  }
}

export function lexicalThis(): number {
  const source = new Box(11);
  const target = new Box(100);
  source.installOn(target);
  return target.call(1);
}

lexicalThis() returns 12 in TypeScript/Node.js. The related StoredFunctionCall test reported in #419 on the #418 head returned 101 in USVM, using the target receiver instead of the source receiver. This standalone snippet has not yet been replayed through USVM.

Dependency and source evidence

• [TS] Preserve lexical this of arrow function values in EtsIR jacodb#391 tracks preserving the arrow/function distinction and lexical receiver in EtsIR. This issue owns the USVM call binding after that representation is available.
• Function-reference creation constructs the reference from the lifted method and closure environment.
• Indirect call resolution uses callee.thisInstance for the call.

The source links are pinned to USVM main 53dce8f3. The related failure was observed on the #418 head; it is not claimed as a fresh main-branch replay.

Acceptance criteria

• A stored arrow retains its lexical this when assigned to and called through another object; the example returns 12.
• An ordinary stored function expression still uses its dynamic call receiver.
• A focused test checks the USVM result and confirms a concrete TypeScript/Node.js replay.