Proxy-wrapped callbacks: arr.sort(new Proxy(fn,{})) SEGVs; arr.map/filter/forEach(new Proxy(fn,{})) throw 'function is not a function' #9681

Two related defects found during #9673's investigation; both measured against node, which handles all of these fine.

1. arr.sort(new Proxy(fn, {})) → SIGSEGV (rc 139). js_validate_array_comparator (array/sort.rs:597) dereferences (*ptr).type_tag for any pointer, with none of the is_handle_band guard that get_valid_func_ptr grew in #5976 — so a proxy id landing in the small-handle band is treated as a heap pointer and faults. This is a crash on user-reachable input.

2. arr.map/filter/forEach/…(new Proxy(fn, {})) → TypeError: function is not a function. resolve_callback_ptr never learned the #6320 proxy-callee fallback that js_closure_callN already has. Returning the bare proxy id would route correctly, since DirectCallN falls back to js_closure_callN.

Fixture with node's expected output is ready at scratchpad/w9673/gapfix.ts.

Both were deliberately kept out of PR #9679 (which fixes unrooted array callbacks in the same file) to keep that change reviewable against its own test. They belong together as one follow-up: add the handle-band guard to the comparator validator and the proxy fallback to resolve_callback_ptr, with a fixture covering every Array.prototype higher-order method plus sort, each with a plain function, a proxy-wrapped function, a bound function, and a non-callable (which must still throw the node-matching TypeError, not crash).