fix: fail closed for native collection methods

[Cylop]

Summary

• Replace open-ended Map, Set, and Date native-method dispatch with explicit fail-closed inventories.
• Block proposed Map insertion mutators and support modern Set composition/relation methods with readonly results.
• Preserve set-like operand identity and IteratorClose behavior, and keep Date conversion redispatch on the readonly receiver.
• Align ES2025 Set callback/composition types with runtime behavior.
• Prepare the reviewed patch as 2.0.1; this PR does not publish it.

Verification

• npm run release:check
• npm run test:browser — 22 passed locally (Chromium and Firefox; WebKit required in Linux CI)
• 99 unit tests across 23 files
• Strict type tests, package consumers, inventory tests, website build, and size checks
• 2.0.1 remains unpublished and npm latest remains 2.0.0

Membrane review

• Unknown intrinsic Map/Set/Date members fail closed
• Known mutators reject before invocation
• Date secondary dispatch cannot regain the mutable source receiver
• Set operands preserve iterator cleanup and readonly identity semantics
• Composition results and callback collection types remain readonly

Release order

Merge this PR first. After green main CI and production deployment verification, publish the protected 2.0.1 release workflow. The product-story PR must not merge or deploy until npm verifies both exact 2.0.1 and latest = 2.0.1.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
readonly-view	Ready	Preview	Sep 4, 2026 11:30am UTC