[TS] Support field assignments that change the runtime value sort

[CaelmBleidd]

Problem

TypeScript permits assigning a value whose JavaScript type differs from a field's declared type when the receiver has a union type. The symbolic executor stores fields in separate regions by value sort. After selecting a concrete runtime class, a write of another sort cannot be represented by that class's declared field region. USVM #465 / PR #466 now reports that path as unsupported; it still needs a sound model.

Minimal TypeScript example

class Numeric {
  value: number = 1;
  numericOnly: boolean = true;
}

class Text {
  value: string = "initial";
  textOnly: boolean = true;
}

export function check(useNumeric: boolean): boolean {
  const object = new (useNumeric ? Numeric : Text)();
  object.value = "changed";
  return object.value === "changed";
}

TypeScript accepts this code, and Node.js returns true for both check(true) and check(false). With PR #466, the Text branch is modeled and the Numeric branch is explicitly reported in unsupportedPaths because assigning a string changes the field's runtime value sort.

Expected support

Model the current value of an object field independently of its declared TypeScript type. A write that changes the JavaScript value type must replace the previous value; subsequent reads, including through aliases, must observe the new type and value. Branches that cannot yet be modeled should remain explicitly unsupported rather than produce a stale field value.

Acceptance criteria

• A focused symbolic test covers both branches with no unsupported paths and checks that both return true.
• The generated concrete cases replay in Node.js.
• A second test reads the changed field through an alias and confirms that the original field value is no longer visible.
• Existing typed numeric, Boolean, reference, and any field operations remain correct.

Related: #465 and PR #466. This task concerns value type changes after assignment, not constructor selection.