gap: test_gap_eval_as_value segfaults on Linux (SIGSEGV) — last remaining gap regression #8498

test_gap_eval_as_value segfaults on Linux, and is the only remaining gap regression on main (sweep 32422185436 on 8d1cca158, parity rate 98.4%):

CRASH test_gap_eval_as_value (SIGSEGV (exit 139))
      Perry died after printing 4 line(s); Node exited 0.

The fixture only reads eval as a value — it never calls it (this is the get-intrinsic pattern, '%eval%': eval):

const intrinsics: Record<string, unknown> = { "%Array%": Array, "%eval%": eval, "%Math%": Math };
console.log("has eval key:", "%eval%" in intrinsics);
const e = eval;
console.log("got eval value without throwing:", e !== Symbol.for("unreachable"));

Not in gap_snapshot.json, so this is a regression rather than accepted debt.

Distinct from #8479's unwind class. That family aborted with SIGABRT and panic in a function that cannot unwind; this is a genuine SIGSEGV, so it is a wild/null dereference rather than an abort guard. It is also unaffected by the extern "C-unwind" removals in #8488 — it still crashes on 8d1cca158, which contains them.

Does not reproduce on macOS: compiled and run locally against a current perry-dev build, it exits 0 and its output matches the Node oracle byte-for-byte. So Linux CI is the only place it can be diagnosed, as with the rest of this crash family.

Suggested starting point: eval is classified as a global function (typeof === "function") in perry-codegen/src/expr/helpers.rs, but reading it as a value has to materialise something callable. A plausible shape — and it matches a pattern already seen this week in #8465, where net.connect reached a null JS_NATIVE_HTTP_DISPATCH and silently returned undefined — is that the eval value resolves to a function pointer that is null in the Linux build and gets dereferenced rather than checked. Worth dumping what the %eval% slot actually holds before the crash point.