Error.captureStackTrace: lazily compute .stack header on non-Error targets - #35640

The proto-chain walk and the `jsNull()` re-entrancy sentinel (both added in this PR's follow-up commits) interact incorrectly: when `v` is `jsNull()`, `v ? dynamicDowncast<JSArray>(v) : nullptr` yields `nullptr` and the loop *continues* to the prototype instead of stopping, so a re-entrant `.stack` read on a child whose own slot holds the sentinel walks past it and finds/formats an ancestor's unresolved CallSite array. Fix: break (and return `jsUndefined()`) when `v.isNull()`; only continue on e

The exception-path restore (`errorObject->putDirect(vm, privateName, callSites, 0)`) is only useful when `.stack` is still the CustomAccessor — but if the throw came from `Error.prepareStackTrace` itself, `formatStackTraceToJSValue(..., prepareStackTrace)` has already replaced `.stack` with a data property (the temp string) *before* invoking the callback, so the restored `JSArray<CallSite>` is never consumed and stays pinned to the target for its lifetime. This is the same bounded-retention shap