builder/vm: stabilize json_lint_vm under unified calls

- Fix condition_fn resolution: Value call path + dev safety + stub injection
- VM bridge: handle Method::birth via BoxCall; ArrayBox push/get/length/set direct bridge
- Receiver safety: pin receiver in method_call_handlers to avoid undefined use across blocks
- Local vars: materialize on declaration (use init ValueId; void for uninit)
- Prefer legacy BoxCall for Array/Map/String/user boxes in emit_box_or_plugin_call (stability-first)
- Test runner: update LLVM hint to llvmlite harness (remove LLVM_SYS_180_PREFIX guidance)
- Docs/roadmap: update CURRENT_TASK with unified default-ON + guards

Note: NYASH_DEV_BIRTH_INJECT_BUILTINS=1 can re-enable builtin birth() injection during migration.

apps/selfhost/vm/boxes/vm_kernel_box.nyash

@@ -0,0 +1,32 @@
+// vm_kernel_box.nyash — NYABI Kernel (skeleton, dev-only; not wired)
+// Scope: Provide policy/decision helpers behind an explicit OFF toggle.
+// Notes: This box is not referenced by the VM by default.
+
+static box VmKernelBox {
+  // Report version and supported features.
+  caps() {
+    // v0 draft: features are informative only.
+    return "{\"version\":0,\"features\":[\"policy\"]}"
+  }
+
+  // Decide stringify strategy for a given type.
+  // Returns: "direct" | "rewrite_stringify" | "fallback"
+  stringify_policy(typeName) {
+    if typeName == "VoidBox" { return "rewrite_stringify" }
+    return "fallback"
+  }
+
+  // Decide equals strategy for two types.
+  // Returns: "object" | "value" | "fallback"
+  equals_policy(lhsType, rhsType) {
+    if lhsType == rhsType { return "value" }
+    return "fallback"
+  }
+
+  // Batch resolve method dispatch plans.
+  // Input/Output via tiny JSON strings (draft). Returns "{\"plans\":[]}" for now.
+  resolve_method_batch(reqs_json) {
+    return "{\"plans\":[]}"
+  }
+}
+