feat: with 语句、成员位/移位复合赋值、CALL_NATIVE 无目标修复

with 语句：新增 emit 支持，with 体内自由标识符动态解析（对象属性优先，
回退外层），支持读/写/复合赋值/自增自减/delete/var 初始化动态化，
TO_OBJECT opcode 处理原始值对象，顶层 this 绑定全局对象。

复合赋值：新增 6 个 COMPOUND_MEMBER_BIT_* opcode 支持成员位/移位复合赋值，
修复 computed member 复合赋值覆盖 bug，with 内标识符复合赋值动态化。

CALL_NATIVE：实现全局 isNaN/isFinite 并绑定，用户覆盖 builtin 名时
回退通用调用路径而非报错，局部遮蔽 builtin 名走普通 CALL。

test262: with 34 pass（基线 0），compound-assignment 320 pass（基线 223）

crates/oxide_vm/src/dispatch/member.rs

@@ -55,6 +55,57 @@ impl Vm {
                 "COMPOUND_MEMBER_EXP on non-object",
                 |l, r| l.powf(r),
             ),
+            OpCode::COMPOUND_MEMBER_BIT_AND => self.dispatch_compound_member_bitwise(
+                "COMPOUND_MEMBER_BIT_AND",
+                rd,
+                a,
+                b,
+                "COMPOUND_MEMBER_BIT_AND on non-object",
+                |l, r| l & r,
+            ),
+            OpCode::COMPOUND_MEMBER_BIT_OR => self.dispatch_compound_member_bitwise(
+                "COMPOUND_MEMBER_BIT_OR",
+                rd,
+                a,
+                b,
+                "COMPOUND_MEMBER_BIT_OR on non-object",
+                |l, r| l | r,
+            ),
+            OpCode::COMPOUND_MEMBER_BIT_XOR => self.dispatch_compound_member_bitwise(
+                "COMPOUND_MEMBER_BIT_XOR",
+                rd,
+                a,
+                b,
+                "COMPOUND_MEMBER_BIT_XOR on non-object",
+                |l, r| l ^ r,
+            ),
+            OpCode::COMPOUND_MEMBER_SHL => self.dispatch_compound_member_shift(
+                "COMPOUND_MEMBER_SHL",
+                rd,
+                a,
+                b,
+                "COMPOUND_MEMBER_SHL on non-object",
+                false,
+                false,
+            ),
+            OpCode::COMPOUND_MEMBER_SHR => self.dispatch_compound_member_shift(
+                "COMPOUND_MEMBER_SHR",
+                rd,
+                a,
+                b,
+                "COMPOUND_MEMBER_SHR on non-object",
+                true,
+                false,
+            ),
+            OpCode::COMPOUND_MEMBER_USHR => self.dispatch_compound_member_shift(
+                "COMPOUND_MEMBER_USHR",
+                rd,
+                a,
+                b,
+                "COMPOUND_MEMBER_USHR on non-object",
+                true,
+                true,
+            ),
             _ => unreachable!("non-member opcode passed to dispatch_member_op"),
         }
     }
@@ -180,4 +231,60 @@ impl Vm {
         self.set_member_prop(obj, prop_name_si, new_val, receiver)?;
         Ok(())
     }
+
+    fn dispatch_compound_member_bitwise<F>(
+        &mut self, op_name: &str, rd: usize, a: usize, b: usize, error_msg: &str, op: F,
+    ) -> Result<(), String>
+    where
+        F: FnOnce(i32, i32) -> i32,
+    {
+        vm_trace!("{} rd={} a={} b={}", op_name, rd, a, b);
+        let Ok((obj_ptr, prop_name_si)) = self.member_target(rd, b, error_msg) else {
+            return Ok(());
+        };
+        let receiver = self.regs[rd];
+        let ln = {
+            let obj = unsafe { &mut *obj_ptr };
+            let prop_val = self.read_member_prop(obj, prop_name_si, receiver)?;
+            self.coerce_int32_bounded(prop_val)?
+        };
+        let rn = self.coerce_int32_bounded(self.regs[a])?;
+        let new_val = JsValue::int(op(ln, rn));
+        self.regs[a] = new_val;
+        let obj = unsafe { &mut *obj_ptr };
+        self.set_member_prop(obj, prop_name_si, new_val, receiver)?;
+        Ok(())
+    }
+
+    fn dispatch_compound_member_shift(
+        &mut self, op_name: &str, rd: usize, a: usize, b: usize, error_msg: &str, is_right: bool, is_unsigned: bool,
+    ) -> Result<(), String> {
+        vm_trace!("{} rd={} a={} b={}", op_name, rd, a, b);
+        let Ok((obj_ptr, prop_name_si)) = self.member_target(rd, b, error_msg) else {
+            return Ok(());
+        };
+        let receiver = self.regs[rd];
+        let ln = {
+            let obj = unsafe { &mut *obj_ptr };
+            let prop_val = self.read_member_prop(obj, prop_name_si, receiver)?;
+            self.coerce_int32_bounded(prop_val)?
+        };
+        let shift = self.coerce_uint32_bounded(self.regs[a])? & 0x1F;
+        let new_val = if !is_right {
+            JsValue::int(ln.wrapping_shl(shift))
+        } else if is_unsigned {
+            let u = (ln as u32) >> shift;
+            if u <= i32::MAX as u32 {
+                JsValue::int(u as i32)
+            } else {
+                JsValue::float(u as f64)
+            }
+        } else {
+            JsValue::int(ln >> shift)
+        };
+        self.regs[a] = new_val;
+        let obj = unsafe { &mut *obj_ptr };
+        self.set_member_prop(obj, prop_name_si, new_val, receiver)?;
+        Ok(())
+    }
 }

crates/oxide_vm/src/dispatch/misc.rs

@@ -49,6 +49,20 @@ impl Vm {
         self.regs[rd] = self.new_string(result);
     }
 
+    /// ToObject：rd 原地转换。对象直接返回；null/undefined 抛 TypeError；
+    /// 其余原始值包装为对应包装对象（with 对象环境需要）。
+    #[inline(always)]
+    pub(crate) fn dispatch_to_object(&mut self, rd: usize) -> Result<(), String> {
+        vm_trace!("TO_OBJECT rd={} r{}={:?}", rd, rd, self.regs[rd]);
+        let val = self.regs[rd];
+        if val.is_object() {
+            return Ok(());
+        }
+        let obj_val = oxide_runtime_api::to_object(val, self)?;
+        self.regs[rd] = obj_val;
+        Ok(())
+    }
+
     pub(crate) fn dispatch_load_var(&mut self, rd: usize, a: usize) -> Result<bool, String> {
         vm_trace!("LOAD_VAR rd={} r{}={:?}", rd, a, self.regs[a]);
         if a == 254