fix: JS_HANDLE_TAG extraction in js_nanbox_get_pointer, layout guard

- js_nanbox_get_pointer now extracts pointers from JS_HANDLE_TAG (0x7FFB)
  values. Previously these fell through to the default case returning 0,
  causing null pointer dereferences when widget handles crossed module
  boundaries via inline_nanbox_pointer's "already tagged" path.
- Guard unwrap() in layout_stack against None from try_borrow re-entrancy

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: Ralph Kuepper

crates/perry-runtime/src/value.rs

@@ -674,7 +674,7 @@ pub extern "C" fn js_nanbox_is_pointer(value: f64) -> bool {
 
 /// Extract a pointer from a NaN-boxed f64 value.
 /// Also handles raw pointer bits (bitcast from i64) for backward compatibility.
-/// Handles both POINTER_TAG and STRING_TAG.
+/// Handles POINTER_TAG, STRING_TAG, BIGINT_TAG, and JS_HANDLE_TAG.
 /// Returns the pointer as i64.
 #[no_mangle]
 pub extern "C" fn js_nanbox_get_pointer(value: f64) -> i64 {
@@ -693,6 +693,12 @@ pub extern "C" fn js_nanbox_get_pointer(value: f64) -> i64 {
         return jsval.as_bigint_ptr() as i64;
     }
 
+    // JS_HANDLE_TAG (0x7FFB): used for V8 handles and Perry UI widget handles
+    // when values pass through inline_nanbox_pointer's "already tagged" path.
+    if (bits & TAG_MASK) == JS_HANDLE_TAG {
+        return (bits & POINTER_MASK) as i64;
+    }
+
     if bits != 0 && bits <= POINTER_MASK {
         let upper = bits >> 48;
         if upper == 0 || (upper > 0 && upper < 0x7FF0) {