fix(engine): invalidate getter inline caches after mutation

[pathscale]

A getter can change its receiver's shape while the VM is resolving the property. The inline cache previously stored the resolved slot against the post-getter shape, so later reads could dispatch the getter again after it had installed an own value. In Chuzz, a memoizing DOM event getter then attempted to redefine a non-configurable property on every event.

This gives unique-shape insertions a fresh identity and records property/global getter cache entries against the shape that was actually searched. The focused regressions cover unique prototype getters, ordinary mutation, an event-style callback, and global getter mutation. The workspace version moves to 1.0.6 so the fix can publish as one compatible dependency batch.

Validation:

• cargo fmt --all -- --check
• 14 focused inline-cache tests passed
• cargo clippy -p ps-boa-engine --lib --no-deps -- -D warnings -A clippy::manual_assert_eq
• Chuzz exact-source workspace: 89 app tests, 15 control tests, and all three integration tests passed

Plain -D warnings is currently blocked by existing manual_assert_eq findings in unchanged core/gc/src/cell.rs and core/engine/src/value/equality.rs. The fork's automatic gate already documents and handles that upstream-only lint.