fix(scope): generalize the carrier's proxy-invariant guard; keep the real constructor

Codex follow-up findings on the carrier commit, both verified:

B: the invariant guard only protected the bind path — an overlay key
colliding with a non-configurable, non-writable OWN prop of a (pathological)
base would have the get trap report the overlay value, which the engine
rejects as a proxy invariant violation (TypeError at read time). The pin
check now runs FIRST and covers both invariant-pinned shapes (non-writable
own data prop reported as-is; getterless non-configurable accessor reported
undefined via the delegated read) before overlay and bind alike. Such a base
forgoes scope filtering by construction — correctness of the read beats
filtering for a base no production code ships.

C: `constructor` is looked up for identity, never invoked as a subject
method — binding it broke `carrier.constructor === Subject` for no benefit;
it now returns raw (the same special-case withProps had). Both pinned in
scope.spec: the frozen-own-filter collision yields the base's value without
throwing, and class identity survives the carrier.

packages/core/scope/tests/scope.spec.ts

@@ -222,6 +222,28 @@ describe('scopeTarget dispatch filtering', () => {
     // it from shadowing the subject's own prototype-surface members.
     expect(String(carrier)).toBe('base-str')
   })
+
+  it('honors the get invariant even when an overlay key collides with a frozen own prop of the base', () => {
+    // Pathological but engine-enforced: a base whose own [Context.filter] is
+    // a non-configurable, non-writable data prop pins what any proxy over it
+    // may report for that key. The carrier must yield the base's value (an
+    // overlay there would be a runtime TypeError from the engine, not a
+    // filtering choice). Such a base forgoes scope filtering by construction.
+    const pinnedFilter = (): boolean => true
+    const base = {}
+    Object.defineProperty(base, Context.filter, { value: pinnedFilter, writable: false, configurable: false })
+    const carrier = scopeTarget(base, { name: 'key' })
+    expect((carrier as Record<symbol, unknown>)[Context.filter]).toBe(pinnedFilter)
+  })
+
+  it('keeps the real constructor: class identity survives the carrier', () => {
+    class Subject { work(): string { return 'w' } }
+    const subject = new Subject()
+    const carrier = scopeTarget(subject, subject)
+    // `constructor` is looked up, never invoked as a subject method — binding
+    // it would break `carrier.constructor === Subject` for no benefit.
+    expect(carrier.constructor).toBe(Subject)
+  })
 })
 
 describe('carrier marks', () => {