Dispatcher: cover :closure, :set_upvalue, and open-upvalue ops (B5c-v2)

[davydog187]

Tracked by plan: .agents/plans/B5c-v2-dispatcher-closures.md

The plan file is the source of truth for goal, scope, success criteria, and implementation notes. Comments here are for discussion; the plan is for execution.

Why now

The closures benchmark is the worst gap to C Lua (15.8x slower) and the inner counter function is tantalisingly close to running on the dispatcher: of its four opcodes (get_upvalue, add, set_upvalue, return_one), three are already covered. The single uncovered :set_upvalue collapses the entire prototype to the interpreter.

Coverage additions in this PR:

• :closure — closure construction with upvalue capture
• :set_upvalue
• :get_open_upvalue, :set_open_upvalue — open-cell access for captures of mutable locals
• :vararg, :return_vararg
• :return with count > 1
• :generic_for, :self, :tail_call

After this PR no prototype falls back to the list-of-tuples interpreter for opcode-coverage reasons.

Blocked on

• Dispatcher: cover table opcodes and :numeric_for (B5b-v2) #271 (B5b-v2 dispatcher table opcodes + numeric_for)

When this work is picked up

1. The branch named in the plan's frontmatter is created.
2. A PR is opened with Closes #<this-issue> in the body.
3. Merge closes this issue.

For strategic context, see ROADMAP.md.