Fix #804: Delay protect() mechanism until desugaring.

The fix is decomposed in two commits. In the first commit the `compiler/` is untouched, so that we can simulate a binary compatibility scenario and verify that the deserialization-time fix works.

The second commit cleans up the compiler not to emit raw `JSApply`s anymore.
You can't remove protect in `0.5.x`, since old IR will still have it and linking with IR checking will fail. (This is more a question of philosophy, does supported IR need to typecheck?)...