Fix VM: string handler no longer hijacks length() on non-strings; ArrayBox.length returns correct values (fixes json_lint loop). Add string-literal reader init guard earlier

apps/lib/json_native/lexer/scanner.nyash

@@ -293,6 +293,11 @@ box JsonScanner {
     // 文字列リテラルを読み取り（クォート含む）
     read_string_literal() {
         local start_pos = me.position
+        // Save starting position to _tmp_pos so that substring/range checks
+        // do not depend on a previous reader’s value (PHI-safe, loop-safe).
+        // Other high-level readers (read_number/read_identifier) already
+        // initialize _tmp_pos; string literal must do the same.
+        me._tmp_pos = me.position
         
         // 開始クォート
         if me.current() != "\"" {