fix(ops): build fast-call errors without re-entering JS (#35042)
When an op2 fast call returns an Err, the generated early-exit code
built the exception with to_v8_error, which synchronously invokes the JS
buildCustomError callback. That runs user-reachable JavaScript in the
middle of a V8 fast call, which the fast-call contract forbids: the
callback can detach an ArrayBuffer argument, leaving the JIT to write
through a now-freed backing-store pointer after the call returns, a
use-after-free.
This builds the exception with native V8 APIs via throw_js_error_class
so no JavaScript is re-entered while the fast call is in flight. The slow
path is unchanged and still reconstructs custom error classes.
