Check frozen class statement coverage by native batch replay

[CaelmBleidd]

Class coverage needs an outcome-independent universe and checked native hits of the original executable class statements. Add a bounded batch replay helper that reuses the existing TypeScript class AST instrumenter, checked local source-closure resolver, tagged value codec, native loader and invokePropertyOnce admission/clone contract. It leaves the symbolic/frontend source unchanged and applies counters only in separate native source overlays.

The helper freezes source hashes and exact AST statement IDs before treatments. Original and counted variants run twice, with the same input sequence and original property outcome. An optional diagnostic scenario checks returned values/state through a separate module trajectory so it cannot mutate the oracle stream. Oracle-only verification stays explicitly weaker. Rejected preconditions, module loading and diagnostic execution do not add predicate coverage. The existing instrumenter rejects unsupported class static initialization rather than silently changing the denominator. Stale source, unsupported values, outcome/scenario mismatch, nondeterminism or unknown statement IDs produce no credited hits.

Stacked on #583 at 554d6b6b8f727163f23d26f17bedef42a74f48a7. Own diff: two files, +331. This introduces no runtime session, generation loop, selector policy or README. Only this PR's own commit should move after its dependencies are merged.

Validation: three native regressions passed for exact two-branch statement coverage, an always-true oracle that must not hide changed scenario results, and a module-counter scenario whose diagnostic calls must not alter credited predicate paths. The installed public campaign plus this helper completed all four functional comparison modes. This verifies the declared native scenario observations, not complete symbolic heap equivalence or scientific superiority.