fix(runtime): suggest --unstable-unsafe-proto after __proto__ assignment

[bartlomieju]

Deno disables the Object.prototype.__proto__ accessor by default to guard
against prototype pollution. It did this by deleting the property, so reads
return undefined and writes silently create a useless own property without
changing the prototype. These quiet failures are hard to track down when code
accidentally relies on __proto__.

Making the accessor throw instead (#34730) surfaced those bugs but broke real
packages such as Playwright, and was reverted (#34772). This takes a middle
ground: it keeps the silent behavior, but installs an accessor that reproduces
the deleted semantics exactly (read returns undefined, write creates an own
data property, the prototype is unchanged) while recording the first
assignment in a process-global flag. When the program later crashes, the
uncaught-error formatter appends a hint to run again with
--unstable-unsafe-proto. Programs that never touch __proto__, and runs with
the flag already enabled, are unaffected.

One consequence is that the accessor is now present in both modes (which
matches Node, where it always exists), so Object.hasOwn(Object.prototype, "__proto__") is now true by default rather than false. The detection in
the existing tests and the unsafe-proto fixture therefore switches from
checking presence to checking behavior: reading __proto__ returns undefined
only when the accessor is disabled.