[keichi]

#322 switched hash-array insertion (array with key) to Object.defineProperty for every entry so that a parsed key of "__proto__" becomes an own property instead of replacing the prototype. That is much slower than plain assignment.

This PR rejects "__proto__" keys at parse time instead and uses plain assignment for all other keys. The generated code reads the key into a temp variable once:

var $tmpN = item.key;
if ($tmpN === "__proto__") {
  throw new Error("Invalid key: __proto__");
}
lhs[$tmpN] = item;

Behaviour change vs #322: parsing an entry whose key is "__proto__" now throws Invalid key: __proto__. Before, the entry was stored as an own property. The regression test from #322 now expects the throw.

Benchmark

Parsing uint32le("len").array("items", { length: "len", key: "id", type: uint32le("id").uint16le("v") }) with 1000 entries, 20000 iterations after warmup, Node v26.8.2:

	us/parse (3 runs)
master	60.5 / 60.9 / 61.0
this branch	7.3 / 7.2 / 7.3

About 8x faster.