fix: generate tmp variables for safe navigation on binary/ternary/unary expressions

[Brooooooklyn]

needs_temporary_in_safe_access() in expand_safe_reads was missing match arms for IrExpression::Binary, Ternary, Not, and Unary. When a safe property read like (pipeBind(...) || fallback)?.name had a Binary receiver, the function fell through to _ => false instead of recursing into operands to detect the pipe binding. This caused the pipe to be evaluated twice with inflated binding slot indices.

---

Note

Medium Risk
Touches compiler IR transformation logic for safe navigation and temporary allocation, which can subtly affect generated JS semantics and slot/indexing across templates, though the change is localized and covered by a new regression test.

Overview
Fixes expand_safe_reads temporary-detection so safe-navigation receivers that are IrExpression::Binary, Ternary, Not, or Unary are recursively inspected for side-effecting subexpressions (notably pipe bindings), ensuring a temp variable is generated instead of re-evaluating the receiver.

Adds an integration snapshot test covering ((data$ | async) || fallback)?.name, asserting the compiled output assigns the binary/pipe expression to tmp_* and uses it for the null guard and property access (avoiding duplicate pipeBind calls and slot/index drift).

^{Written by Cursor Bugbot for commit e1b896d. This will update automatically on new commits. Configure here.}