Fix GH-23628: Tracing JIT reads undefined property slots of lazy proxies

[lisachenko]

A lazy proxy keeps its own property slots IS_UNDEF|IS_PROP_LAZY even after it has been initialized, and the object handlers forward every property access to the real instance.

This caused the #23628 bug, because the tracing JIT was not aware of this in two places:

1. When the recorded trace contained a FETCH_OBJ_R/IS/W on a known property whose slot was IS_UNDEF, the known-offset fast path was still compiled. For a lazy proxy this path never succeeds, and it deoptimized on every execution. Use the generic code path (that falls back to the object handlers for undefined slots) when the slot was IS_UNDEF at recording time. This also covers uninitialized and unset properties.

2. During deoptimization of a failed result type guard after FETCH_OBJ_IS, an IS_UNDEF slot was turned into NULL, assuming an undefined property. For a slot flagged IS_PROP_LAZY the fetch has to be forwarded to the real instance instead, so re-execute the opline in the VM, the same way it is already done for FETCH_OBJ_R.

[lisachenko]

For discussion: the compile-side change also routes uninitialized or unset typed properties through the generic path when the trace recorded the slot as undefined. That's a deliberate trade, since the fast path could never succeed in that state.