ZJIT: Fix polymorphic_summary to chase guards on profile entries (#17238)HEADmaster

## Summary

Using `chase_insn` instead of `find_const` in `polymorphic_summary`.

## Why

When an ivar instruction is specialized, `self` is reassigned to a GuardType/RefineType wrapper, and profiling records that wrapper.
The second-and-later polymorphic ivar/`defined?` on the same `self` therefore had its entry recorded against the wrapper, which `find_const` can't peel.
So `polymorphic_summary` returned `None` and fell back to a generic `DefinedIvar`/`GetIvar`/`SetIvar` instead of inline shape branches.

## Benchmarks

```
Bench (arm64 linux devcontainer, ruby/ruby-bench, warmup=10 bench=20)
  master = HEAD 925fa46811   staged = master + patch (hir.rs: find_const→chase_insn)

  Throughput              master/staged
    lobsters              0.970 (-3.0%, within ±2-9% noise)
    railsbench            1.017 (+1.7%, within ±2-5% noise)

  --zjit-stats            lobsters / railsbench   (staged vs master, %diff)
    code_region_bytes     +0.5%   / +0.1%
    guard_type_count      -1.0%   / -0.0%
    compile_hir_time_ns   +3.7%   / +4.7%
    invalidation_time_ns  +4.1%   / -1.6%
```

0 files changed, 0 insertions, 0 deletions