[php-src] Issue #20880: JIT (tracing): NAN float comparisons incorrectly return true

Issue: https://github.com/php/php-src/issues/20880
Author: sanmai

### Description

PHP JIT (tracing mode) sometimes incorrectly evaluates `NAN > $float` or `NAN < $float` as TRUE instead of FALSE, violating IEEE 754 semantics. 

The following code:

```php
<?php
class Tracker {
    private float $max = NAN;
    private int $count = 0;

    public function observe(float $value): void {
        ++$this->count;
        if ($this->count === 1) {
            $this->max = $value;
            return;
        }
        if ($value > $this->max) {
            $this->max = $value;
        }
    }

    public function getMax(): float { return $this->max; }
}

// Warm up JIT
for ($i = 0; $i < 100000; $i++) {
    $t = new Tracker();
    $t->observe(1.0);
    $t->observe(2.0);
    $t->observe(3.0);
    $t->getMax();
}

// Test: NAN > M_PI should be FALSE per IEEE 754
$t = new Tracker();
$t->observe(M_PI);
$t->observe(NAN);
var_dump($t->getMax());
```

When running with:

```
php -d opcache.enable_cli=1 -d opcache.jit=tracing -d opcache.jit_buffer_size=64M
```

Resulted in this output:
```
float(NAN)
```

But I expected this output instead:
```
float(3.141592653589793)
```


### PHP Version

```plain
PHP 8.4.16 (cli) (built: Dec 21 2025 05:25:12) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.4.16, Copyright (c) Zend Technologies
    with Zend OPcache v8.4.16, Copyright (c), by Zend Technologies
```

### Operating System

_No response_