Core‑Direct in-proc (opt-in) + negative canaries

- Runner: add HAKO_CORE_DIRECT_INPROC=1 to run MIR(JSON v0) directly in-proc (avoid child Hako wrapper); fallback preserved
- Update core_direct_string_bounds_rc_vm to enable in-proc toggle
- Add Bridge v1 negatives (Method/ModuleFunction/Constructor via Closure variants already added)
- Stage‑B alias table fail-fast tag in resolver; quick remains green

tools/smokes/v2/profiles/quick/core/core_direct_string_bounds_rc_vm.sh

@@ -20,7 +20,7 @@ code='static box Main { method main(args) { local s="abc"; local t=s.substring(-
 json=$(stageb_compile_to_json "$code") || { echo "[FAIL] core_direct_string_bounds_rc_vm (emit failed)" >&2; exit 1; }
 
 set +e
-NYASH_GATE_C_CORE=1 HAKO_GATE_C_CORE=1 HAKO_CORE_DIRECT=1 \
+NYASH_GATE_C_CORE=1 HAKO_GATE_C_CORE=1 HAKO_CORE_DIRECT=1 HAKO_CORE_DIRECT_INPROC=1 \
   NYASH_QUIET=1 HAKO_QUIET=1 NYASH_CLI_VERBOSE=0 NYASH_NYRT_SILENT_RESULT=1 \
   "$NYASH_BIN" --json-file "$json" >/dev/null 2>&1
 rc=$?