perf: member 复合写路径接入 IC 写命中（depth 0）消除每次 DashMap 查询与回写

set_member_prop 增加 ic_set_hit_own（仅接受 depth==0 槽，跳过读侧学习的
原型条目防原型污染）命中直写槽，ext_pc 由 read_member_prop 显式带出消除
隐式 pc 契约；写新属性 miss 分支（IC_SET 分发 + member 写）统一改
CreateDataProperty 快路径（保留原型链 setter/readonly 检查），砍掉
ordinary_set 全链路的重复查询与 shape 转换开销。

crates/oxide_vm/src/dispatch/property.rs

@@ -1,6 +1,5 @@
 use crate::{ic_debug, ic_trace, vm_trace};
 use oxide_bytecode::opcode::{OpCode, IC_EXT_WORDS};
-use oxide_kernel::prop_forge::PropTemplate;
 use oxide_runtime_api as coercion;
 use oxide_types::object::JsObject;
 use oxide_types::private_key::{int_key_value, is_int_key, make_private_name_id};
@@ -443,23 +442,14 @@ impl Vm {
             ic_debug!("IC_SET write-back shape={} slot={}", obj.shape_id(), pos);
         } else {
             self.profiling.record_ic_miss();
-            let old_shape = obj.shape_id();
-            self.ordinary_set_dispatch(obj, prop_name_si, value, receiver)?;
-            if old_shape != obj.shape_id() {
-                if let Some(pos) = self.kernel_core.shape_forge().lookup_position(obj.shape_id(), prop_name_si) {
-                    ic_helper::write_ic_back(self.bytecode_mut(), ic_pc, obj.shape_id(), pos, 0);
-                    ic_debug!("IC_SET write-back shape={} slot={}", obj.shape_id(), pos);
-                    self.kernel_core.prop_forge().upsert(
-                        obj.shape_id(),
-                        PropTemplate {
-                            shape_id: obj.shape_id(),
-                            prop_name: prop_name_si,
-                            position: pos,
-                            generation: obj.generation(),
-                        },
-                    );
-                }
+            prop_cache_miss();
+            // 写新属性（shape 转换）：数组 length / 整数索引键仍走完整
+            // ordinary_set_dispatch 语义，其余走 CreateDataProperty 快路径。
+            if self.named_prop_create_needs_ordinary_set(obj, prop_name_si) {
+                self.ordinary_set_dispatch(obj, prop_name_si, value, receiver)?;
+                return Ok(());
             }
+            self.create_named_prop_fast(obj, prop_name_si, value, receiver, ic_pc, true)?;
         }
 
         Ok(())