Expose browser-shaped MessagePort EventHandler accessors #430

Problem

MessagePort wrappers currently install onmessage and onmessageerror as own writable data properties. Browsers expose both EventHandler properties through accessors on MessagePort.prototype, with per-instance values. The shape difference blocks synchronous observation of a later handler assignment in the unchanged browser extension-host bootstrap even though iframe creation and port transfer succeed.

Parent: #81. Related lifetime owner: #288.

Current package evidence on WebScene fc71e92: extensionIframeBootstrap=true, extensionPortTransferred=true, extensionPortObserverInstalled=false, while the editor Worker reply and UI timer remain healthy. Evidence was recorded in /private/tmp/vscode-smoke-fc71e92/native-smoke.json and smoke-summary.json.

Acceptance

• Expose onmessage and onmessageerror as configurable enumerable accessors on MessagePort.prototype, matching Chromium descriptor placement and observable assignment behavior.
• Store handlers per MessagePort instance across Window, dedicated Worker, iframe, and transferred wrappers.
• Preserve assignment, reassignment, null clearing, receiver identity, EventTarget listeners, queued delivery, transfer ownership, close, and termination behavior.
• Add Chromium/WPT oracle coverage and focused native contracts.
• Complete 100 transfer/assignment/release cycles with bounded queue, binding, heap, RSS, and latency metrics.
• Pass the unchanged packaged extension-host observer through installation and Ready/Initialized traffic without application patches.