Inline-cache state visualizer built on --trace-ic

[pavlof01]

Context

--trace-ic is already in the flag catalog (packages/engine-runtime/src/flags.ts, category inline-caches), and lib/parseV8Trace.ts already recognises IC transition lines — it just renders them as text.

Proposal

• Group IC events per call site and per property access, and render the state machine each one walks: uninitialised -> monomorphic -> polymorphic -> megamorphic.
• Anchor each call site to its source line (shares the mapping work in the source <-> bytecode issue).
• Flag the transitions that matter: the first polymorphic step and the fall to megamorphic, with the maps involved.

Acceptance criteria

• A snippet calling one function with two different object shapes visibly walks mono -> poly.
• Events that cannot be attributed to a source position still appear, grouped as "unattributed".