runtime/object-model: pass correct this binding to callback invocations such as String.replace #3578

Summary

Built-ins that invoke user callbacks pass the correct callback this value and arguments, including String.prototype.replace replacement callbacks.

Affected Test262 rows

• fix(compile): file: deps inside cwd no longer strip FFI imports on --target web (closes #209) #211 language/function-code/10.4.3-1-100-s.js (runtime-fail: Uncaught exception: "ab".replace("b", f) Expected SameValue(«"a\u0000"», «"aa"») to be true)
• Pry code example not available? #213 language/function-code/10.4.3-1-102-s.js (runtime-fail: Uncaught exception: Expected SameValue(«"a\u0000"», «"aa"») to be true)

Perry actual behavior from report

• 1 x runtime-fail: Uncaught exception: "ab".replace("b", f) Expected SameValue(«"a\u0000"», «"aa"») to be true
• 1 x runtime-fail: Uncaught exception: Expected SameValue(«"a\u0000"», «"aa"») to be true

Node / ECMAScript expected behavior

Built-ins that invoke user callbacks pass the correct callback this value and arguments, including String.prototype.replace replacement callbacks.

Likely subsystem

built-in callback dispatch / implicit this handling

Acceptance criteria

• The String.replace callback rows produce "aa" rather than NUL/undefined-derived output.
• Strict and sloppy callback forms agree with Node.
• Existing replacement-string behavior does not regress.

Validation

Run the Test262 differential against the affected area and confirm these rows leave the gap report:

scripts/test262_subset.py --root vendor/test262 --dir language/function-code --sample-cap 99999 --report /tmp/FUNC_CALLBACK_THIS.json

This is Perry language/runtime semantics triage, not a Node core API compatibility issue.