String spread produces raw NaN-boxed floats instead of characters

[proggeramlug]

Description

[..."hello"] should produce ["h", "e", "l", "l", "o"] but instead produces an array of raw NaN-boxed float values (the STRING_TAG bits interpreted as f64). chars[0] returns a huge number and typeof chars[0] is "number".

Repro

const chars = [..."hello"];
console.log(chars.join(","));  // Expected: h,e,l,l,o
console.log(typeof chars[0]); // Expected: string, Actual: number

Root cause

The spread operator on a string likely produces NaN-boxed string pointers that are stored in the array as f64, but the array element type isn't tracked as string — so IndexGet returns the raw bits as a number instead of unboxing through the string path.

Confirmed pre-existing (present before v0.5.2 optimizations). Affects test_edge_rest_spread_defaults line 42.

[proggeramlug]

Fixed in 8bfdb65. String spread now calls js_string_to_char_array to split the string into individual character strings instead of passing the NaN-boxed pointer to js_array_concat. test_edge_rest_spread_defaults is now a MATCH.