[TS] Preserve dense array search applicability after payload writes

[CaelmBleidd]

Array search guards used whole shared payload-region identity as a proof that no slots were missing. An in-range write, or a write to another array in that region, invalidated that test even when the receiver remained dense. Ordinary source programs such as splitting a string, updating an element, then indexOf(undefined) stopped as unsupported.

Use the existing per-receiver dense-shape proof for search applicability. It survives payload updates, checks the current length, and is revoked by own-slot deletion. No search loop, equality/NaN rule, callback semantics, bound or fallback policy changes. Other model guards that require stronger value snapshots are unchanged.

Validation: the new source regression fails with the previous guard (no completed states after an ordinary write), and passes for receiver writes, unrelated writes and boxed undefined values. A deletion regression still takes the indexOf residual path. Three focused test methods passed, including replay of the new witnesses and existing sequence/callback witnesses in Node; strict usvm-ts detektMain/detektTest passed. This is an applicability repair, not a measured general array-search performance claim. Full suites left to CI.