fix(native): identity-stable, spy-able turboStubs

[danfry1]

Problem

Unmocked native modules under the native engine are served by turboStub Proxies that minted a fresh stub object on every property access, and whose get trap never consulted the proxy target. Two consequences:

1. NativeModules.Foo !== NativeModules.Foo — identity-unstable across reads (breaks instanceof-style assertions and captured-reference comparisons).
2. vi.spyOn(NativeModules.Foo, 'method') silently recorded nothing — the spy landed on a throwaway object while callers kept receiving fresh closures. This is a real migrated-Jest-suite pattern, and the failure mode is "assertion never fires", not an error.

Change

• Stubs memoized per module name in the shared boundary state: NativeModules.Foo === TurboModuleRegistry.get('Foo'), matching bridgeless RN where NativeModules proxies TurboModuleRegistry.
• Methods memoized as own target properties on first read (via defineProperty — sloppy-mode assignment of __proto__ would invoke the inherited setter and swap the target's prototype), with explicitly-set properties winning, so vi.spyOn records, mockRestore restores, and repeated reads are identity-stable.
• has: () => true — consistent with the get trap serving a callable for every key, and required by vi.spyOn's in existence check. RN 0.86's source was audited for in-operator feature detection against native modules: none found.
• Hot runtime: each stub registers a surgical-reset callback clearing per-file overrides (spies, direct assignments) between files while preserving stub identity for resident libraries. The reset registry now runs before the Dimensions/Appearance value-restores, because those restores route through the very stubs being cleared — restore-first would send the restore through the previous file's dead override and leak state across files. That ordering leak was demonstrated in pre-merge review (its expression is environment-dependent; the clear-then-restore order is strictly safer either way), and the hot-isolation suite now carries a dead-override regression scenario. The registry stays bounded (one callback per distinct module name; verified ~32 after full RN preload).

Under the default engine each test file gets a fresh process, so the reset path never fires there.

Review

Independently adversarially reviewed pre-PR (vitest 4.1.8 spy mechanics traced against @vitest/spy source; RN 0.86 grepped for in-detection; Proxy invariants checked; await stub thenable behavior confirmed unchanged). Review findings (reset ordering, __proto__ memoization, stale comment, test-shape gap) are incorporated.

Tests

• tests/native-unit.test.ts: stub identity across module reads and method reads, spy + restore round-trip, NativeModules ↔ TurboModuleRegistry shared identity, reset-registry clears overrides while preserving identity.
• tests-native/native-module-spies.test.ts: same guarantees end-to-end under the real native engine (spy on a never-before-accessed method — fails without the has trap; callback/promise conventions preserved after memoization).
• tests-native/hot-isolation/: file 1 leaves a dead override on the Appearance stub; file 2 asserts both the boundary value and the override are gone (direct NativeModules reads bypassing RN's JS-side cache).

Full gate: mock 1280, native suites (stock/hot/isolation/android/navigation/soak) green, crosscheck 75/75, lint/format/typecheck clean.