[codex] Fix Object.prototype.toString brands for functions and namespaces

[andrewtdiz]

Summary

Part of #3986.

This fixes Object.prototype.toString.call(value) branding for callable values and the built-in namespace objects covered by Node:

• brands closure-backed functions, class object pointers, and class refs as [object Function] before the numeric fallback
• installs intrinsic Symbol.toStringTag values for Math, JSON, and Reflect
• records intrinsic tag descriptors as { writable: false, enumerable: false, configurable: true }
• adds a focused parity fixture for callable brands, namespace brands/descriptors, and explicit tag overrides

Root Cause

Perry's canonical object-to-string helper did not recognize closure-backed functions or class values before falling through to generic object/number branding. The Math, JSON, and Reflect namespace objects also had reflected members but no intrinsic Symbol.toStringTag, so the default tag stayed [object Object].

Validation

• Pre-fix latest main plus the new fixture failed with ordinary: [object Object] where Node reports [object Function]
• PERRY_NO_AUTO_OPTIMIZE=1 npm exec --yes --package=node@26 -- bash -lc 'node --version; ./run_parity_tests.sh --suite node-suite --module globals --filter object-tostring-brands'
• PERRY_NO_AUTO_OPTIMIZE=1 npm exec --yes --package=node@26 -- bash -lc 'node --version; ./run_parity_tests.sh --suite node-suite --module globals --filter builtin-namespace'
• PERRY_NO_AUTO_OPTIMIZE=1 npm exec --yes --package=node@26 -- bash -lc 'node --version; ./run_parity_tests.sh --suite node-suite --module globals --filter function-tostring'
• CARGO_TARGET_DIR=/tmp/perry-object-tostring-check cargo check -p perry-runtime
• cargo fmt --all -- --check
• git diff --check
• ./scripts/check_file_size.sh