Map/Promise/ArrayBuffer/DataView lack the own Symbol.toStringTag property on their prototype, though Object.prototype.toString already reports the right brand #10633

PR #10632 added Symbol.toStringTag to 15 Web/runtime built-ins (URL, URLSearchParams, Headers,
Request, Response, FormData, Blob, File, AbortController, AbortSignal, TextEncoder,
TextDecoder, EventTarget, Event, CustomEvent) and deliberately stopped short of the core ES intrinsics.

What is still missing: Map, Promise, ArrayBuffer and DataView produce the correct brand string from
Object.prototype.toString.call(x) — that works through a different mechanism — but do not expose the own
Symbol.toStringTag property on their prototype:

Object.prototype.toString.call(new Map());              // "[object Map]"      ✓ correct today
Object.getOwnPropertyDescriptor(Map.prototype, Symbol.toStringTag);  // undefined   ✗ Node gives a descriptor

Node defines it as { value: "Map", writable: false, enumerable: false, configurable: true }.

Why it was left out rather than folded in: these are core ES intrinsics reached through a different and more
load-bearing path than the Web built-ins, so the fix has a different shape and a wider blast radius. PR #10632's
author judged it riskier than the change they were making and scoped it out explicitly rather than attempting
both in one PR — the right call, but it leaves this gap.

Anything that reflects over an intrinsic's prototype descriptors (polyfill detection, spec-conformance suites,
some serializers) will see the difference. Uint8Array already works, so there is a working example in-tree to
follow.