fix(expressions): with-statement PutValue through object environment records (43 tests)

[dowdiness]

Root cause

PutValue on a reference whose base is an object environment record (the with statement scope chain) must write back to the scope object, not the surrounding function environment. The failing tests use a getter that deletes itself on first read — the compound assignment or increment/decrement then calls PutValue with the reference captured before the get, which must target the original scope object.

All failures are from old sputnik/ecma262 test suite (S11.x files) confirming this is a long-standing gap.

Failure breakdown — language/expressions suite (2026-06-21)

Subcategory	Unique failing tests
compound-assignment	33
prefix-increment	5
prefix-decrement	5
Total	43

Reproducer

function testFunction() {
  var x = 0;
  var scope = { get x() { delete this.x; return 2; } };
  with (scope) { x *= 3; }
  // scope.x should be 6 — PutValue must target the scope object
  if (scope.x !== 6) throw new Error('scope.x === ' + scope.x);
}
testFunction();

Fix direction

In the PutValue path for identifier references, when the binding lives in an object environment record (created by with), the put must call [[Set]] on the scope object rather than writing to the nearest variable environment. The reference must carry enough context to know its base environment record type.