fix(#665): compilePackages override + 3 follow-ups to make rate-limiter-flexible work end-to-end

[proggeramlug]

Summary

Four-commit stack closing #665's investigation. After this PR, the issue's original repro import { RateLimiterMemory } from "rate-limiter-flexible"; new RateLimiterMemory({...}) produces an instance whose methods are reachable as function values (no more typeof limiter.consume === "number").

v0.5.892 — resolver opt-in. perry.compilePackages now overrides the built-in NATIVE_MODULES routing. Two-site change in resolve.rs + collect_modules.rs.

v0.5.893 — codegen side-map consistency. Three side maps in compile_module used last-writer-wins .insert() while class_table used first-writer-wins. When two classes are both default-imported into the same file, the mismatch produced phantom method symbols (@perry_method_..._RateLimiterRes_js__RateLimiterRes__delete etc.). Flipped to .entry().or_insert().

v0.5.894 — setTimeout trailing args. setTimeout(fn, delay, ...args) only had a 2-arg codegen arm; 3+ arg calls (e.g. setTimeout(resolve, delay, res) inside Promise executors) fell through and emitted a bare setTimeout symbol the linker couldn't resolve. Added js_set_timeout_callback_args runtime entry + dispatch via js_closure_call0..9.

v0.5.895 — HIR native-instance override. is_native_module only checked the NATIVE_MODULES manifest, so a compile-package-overridden class still got lowered as a native instance. That made instance.method (bare property read) emit NativeMethodCall { method, args: [] } — a zero-arg FFI getter call that returned 0.0 because the binding had no matching FFI entry, so typeof instance.method returned "number". Fixed via thread-local COMPILE_PACKAGES_OVERRIDE set by the compiler driver around each HIR lowering.

End-to-end validation

$ ./probe   # rate-limiter-flexible
typeof limiter: object
typeof limiter.consume: function          ← was "number" before v0.5.895
limiter.consume: [Function (anonymous)]
limiter.points: 3
limiter.duration: 60

Test plan

• cargo build --release -p perry -p perry-runtime -p perry-stdlib — clean
• cargo test --release -p perry — 152 passed
• 37 cjs_wrap unit tests pass unchanged
• cargo test --release --workspace --exclude perry-ui-{ios,tvos,watchos,visionos,android,windows,gtk4} — exit 0, 30 buckets, 0 FAILED
• rate-limiter-flexible: full chain compiles, links, runs; typeof limiter.consume === "function"
• 2-arg setTimeout(fn, delay) and 3-arg setTimeout(fn, delay, ...args) byte-equal to Bun
• CI: lint, cargo-test, parity, compile-smoke, api-docs-drift, security-audit

Scope

Closes all four layers of #665 that this investigation surfaced. Not in scope:

• Calling await limiter.consume(...) end-to-end through Promise resolution — bound-method dispatch via CLASS_VTABLE_REGISTRY works for the drizzle/hono fixtures so it should work here, but I haven't probed the full chain.
• Filling out perry-ext-ratelimit's native surface for users who'd prefer the FFI path over compilePackages.
• Support for >9 trailing args to setTimeout (would need a variadic-dispatcher closure-call helper).

Refs #665.