From Coverage to Causes: Data-Centric Fuzzing for JavaScript Engines