[chrmod]

Follow-up to #67, targeting its branch.

What changes

• Cycles spanning two scriptlet proxies are now rejected. The cycle check stopped at any other proxy created by the wrapper and reported "not cyclic". Setting each of two proxied functions as the other's indirect prototype was therefore accepted, and the next property lookup overflowed the stack. Native functions reject the second call. The check now walks through proxies like any other object.
• The wrapper is smaller. With no need to recognise its own proxies, the WeakSet and the captured add / has / Reflect.apply go away. The handler instanceof Object, handler.setPrototypeOf === undefined and new.target guards are dropped too: every caller is a scriptlet passing an object literal with no setPrototypeOf trap, always with new. Dropping instanceof also removes a Symbol.hasInstance lookup that ran after page scripts.

Testing

• New test: setTimeout and Function.prototype.toString, both proxied by prevent-setTimeout.js, each set as the other's indirect prototype, compared against two native functions. It fails on Reject cyclic prototypes on scriptlet proxies #67 with RangeError: Maximum call stack size exceeded and passes here.
• npm run build and npm test pass locally (10 tests).

Not covered

• An ordinary object adopting a proxy as its prototype, e.g. Object.setPrototypeOf(Function.prototype, Function.prototype.toString). The proxy's trap never runs, so this needs page-wide patching of the prototype setters and is left out.
• If upstream ever adds its own setPrototypeOf trap to a handler, the wrapper shadows it.