Bug #22270: Fix prepend ancestry order in user boxes

• Status: Open
• Assignee: -
• Target version: -
• ruby -v: ruby 4.1.0dev (2026-08-27T04:25:14Z master b4322d9020) +YJIT +MN +PRISM [arm64-darwin27]
• Backport: 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN

[hsbt (Hiroshi SHIBATA)]

In a user box created with gems disabled, prepending to a built-in module inserts it on the wrong side of the target:

box = Ruby::Box.new
box.eval('module BoxDecor; end; Kernel.prepend(BoxDecor)')
box.eval('Object.ancestors.first(5)')
# => [Object, Ruby::Box::Loader, Kernel, BoxDecor, BasicObject]

ensure_origin reads the target's m_tbl before its first write creates the box-local classext, so the origin ICLASS captures the prime m_tbl while the subclass ICLASSes refer the box-local copy made by the CoW. The shared table check in rb_prepend_module then fails and the origin backfill is skipped. With gems enabled the bug is hidden because loading rubygems into the box copies Kernel's classext first.

The fix creates the box-local classext before reading the m_tbl, which is a no-op when boxes are disabled. Also fixes a pre-existing assert_not_include? typo that made test_global_variables error under RUBY_BOX=1.

Pull request: https://github.com/ruby/ruby/pull/18535