feat: 迭代器原型基建：%IteratorPrototype% 链 + 各集合迭代器原型

新增 %IteratorPrototype%（含 @@iterator 返回自身，经原型链被全部迭代器
继承，it[Symbol.iterator]() === it 恒等）与 %ArrayIteratorPrototype%/
%MapIteratorPrototype%/%SetIteratorPrototype%/%StringIteratorPrototype%/
%RegExpStringIteratorPrototype%（链到 %IteratorPrototype%）；Array/Map/Set/
TA/String/matchAll 迭代器包装统一挂对应原型；补 Array/String 的 @@iterator
别名绑定。集合迭代器原型不含 return 方法（规范集合迭代器无 return）。

crates/oxide_vm/src/bindings/bind_array.rs

@@ -70,6 +70,8 @@ pub fn bind_array(core: &Arc<KernelCore>, session: &KernelSession, global: &mut
     if let Some(pos) = core.shape_forge().lookup_position(array_proto.shape_id(), si) {
         array_proto.set_data_meta(pos, PropAttributes::new(true, false, true));
     }
+    // Array.prototype[@@iterator] 与 values 共享同一函数对象。
+    super::bind_well_known_method_alias(core, array_proto, "values", 0);
 
     let ctor_ptr = session.builtin_world().array_constructor.as_ptr() as *mut JsObject;
     bind_constructor!(core, global, "Array", ctor_ptr, oxide_builtins::array::array_constructor::<crate::vm::Vm>, 1, hash: true);

crates/oxide_vm/src/bindings/bind_iterator.rs

@@ -26,4 +26,18 @@ pub fn bind_iterator(core: &Arc<KernelCore>, session: &KernelSession, global: &m
     );
 
     bind_global_value(core, global, "Iterator", JsValue::from_js_object(Box::into_raw(iterator)));
+
+    // %IteratorPrototype% 自身可迭代：@@iterator 返回 this，经原型链被所有
+    // 集合迭代器继承（it[Symbol.iterator]() === it 恒等）。
+    let iter_proto_ptr = session.builtin_world().iterator_proto.as_ptr() as *mut JsObject;
+    let iter_proto = unsafe { &mut *iter_proto_ptr };
+    crate::bindings::bind_well_known_method(
+        session.builtin_world(),
+        core,
+        iter_proto,
+        0,
+        "iterator",
+        oxide_builtins::iterator::iterator_symbol_iterator::<crate::vm::Vm> as *const (),
+        0,
+    );
 }

crates/oxide_vm/src/bindings/bind_string.rs

@@ -61,6 +61,16 @@ pub fn bind_string(core: &Arc<KernelCore>, session: &KernelSession, global: &mut
         core,
         &[("toString", oxide_builtins::string::string_to_string::<crate::vm::Vm> as *const (), 0)],
     );
+    // String.prototype[@@iterator]：逐 code point 迭代字符。
+    super::bind_well_known_method(
+        session.builtin_world(),
+        core,
+        proto,
+        0,
+        "iterator",
+        oxide_builtins::string::string_symbol_iterator::<crate::vm::Vm> as *const (),
+        0,
+    );
 
     let si_str = core.perm_interner().intern("String").0;
     let str_shape = core.shape_forge().make_shape(global.shape_id(), si_str);

crates/oxide_vm/src/bindings/mod.rs

@@ -380,6 +380,19 @@ fn bind_iterator_global(core: &Arc<KernelCore>, session: &KernelSession, global:
         &[("from", oxide_builtins::iterator::iterator_from::<crate::vm::Vm> as *const (), 1)],
     );
     bind_existing_global(core, global, "Iterator", JsValue::from_js_object(Box::into_raw(iterator)));
+
+    // %IteratorPrototype% 自身可迭代（@@iterator 返回 this，经原型链被全部集合迭代器继承）。
+    let iter_proto_ptr = session.builtin_world().iterator_proto.as_ptr() as *mut JsObject;
+    let iter_proto = unsafe { &mut *iter_proto_ptr };
+    bind_well_known_method(
+        session.builtin_world(),
+        core,
+        iter_proto,
+        0,
+        "iterator",
+        oxide_builtins::iterator::iterator_symbol_iterator::<crate::vm::Vm> as *const (),
+        0,
+    );
 }
 
 fn bind_stub_globals(core: &Arc<KernelCore>, session: &KernelSession, global: &mut JsObject) {