[SAS CTF 2026] JSculator writeup

Exploiting a QuickJS-ng fast-array bug to expose stale JSValues, corrupt the global property table, and call std.loadFile