js-on-sx: fn.length reflects actual arity via lambda-params

Previously fn.length always returned 0 — so the 'length value' test262 tests
failed. Now js-fn-length inspects the lambda's parameter list (via
lambda-params primitive) and counts non-rest params. For functions/components
and callable dicts it still returns 0 (can't introspect arity in those cases).

6 new unit tests, 520/522 total.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

lib/js/test.sh

@@ -1213,6 +1213,20 @@ cat > "$TMPFILE" << 'EPOCHS'
 (epoch 3709)
 (eval "(js-eval \"var a=[1,2,3]; a.keys().join(',')\")")
 
+;; ── Phase 11.fnlen: fn.length uses arity from lambda-params ─
+(epoch 4100)
+(eval "(js-eval \"function f(){} f.length\")")
+(epoch 4101)
+(eval "(js-eval \"function f(a){} f.length\")")
+(epoch 4102)
+(eval "(js-eval \"function f(a,b,c){} f.length\")")
+(epoch 4103)
+(eval "(js-eval \"function f(a, ...rest){} f.length\")")
+(epoch 4104)
+(eval "(js-eval \"Math.abs.length\")")
+(epoch 4105)
+(eval "(js-eval \"Math.floor.length\")")
+
 ;; ── Phase 11.coerce2: Number coercion edge cases ────────────
 (epoch 4000)
 (eval "(js-eval \"Number('abc')\")")
@@ -1969,6 +1983,14 @@ check 3707 "arr.toReversed"                '"2,1,3"'
 check 3708 "arr.toSorted"                  '"1,1,3,4,5"'
 check 3709 "arr.keys"                      '"0,1,2"'
 
+# ── Phase 11.fnlen: fn.length arity ───────────────────────────
+check 4100 "fn () length"                  '0'
+check 4101 "fn (a) length"                 '1'
+check 4102 "fn (a,b,c) length"             '3'
+check 4103 "fn rest length"                '1'
+check 4104 "Math.abs.length"               '1'
+check 4105 "Math.floor.length"             '1'
+
 # ── Phase 11.coerce2: Number coercion edge cases ─────────────
 check 4001 "isNaN(Number('abc'))"          'true'
 check 4002 "parseInt leading digits"       '123'