builder/vm: stabilize json_lint_vm under unified calls

- Fix condition_fn resolution: Value call path + dev safety + stub injection
- VM bridge: handle Method::birth via BoxCall; ArrayBox push/get/length/set direct bridge
- Receiver safety: pin receiver in method_call_handlers to avoid undefined use across blocks
- Local vars: materialize on declaration (use init ValueId; void for uninit)
- Prefer legacy BoxCall for Array/Map/String/user boxes in emit_box_or_plugin_call (stability-first)
- Test runner: update LLVM hint to llvmlite harness (remove LLVM_SYS_180_PREFIX guidance)
- Docs/roadmap: update CURRENT_TASK with unified default-ON + guards

Note: NYASH_DEV_BIRTH_INJECT_BUILTINS=1 can re-enable builtin birth() injection during migration.

docs/how-to/self-hosting.md

@@ -19,6 +19,12 @@
 5) LLVM 統合（任意・AOT/ハーネス）
    - 実行: `tools/smokes/v2/run.sh --profile integration`
 
+最小 Ny 実行器（MirVmMin）
+- 目的: Ny だけで MIR(JSON v0) のごく最小セット（const/binop/compare/ret）を実行できることを確認。
+- 実行例（VM）:
+  - `./target/release/nyash --backend vm apps/selfhost/vm/mir_min_entry.nyash`
+  - 引数で MIR(JSON) を渡すことも可能（単一文字列）。簡単な例は `apps/selfhost/vm/mir_min_entry.nyash` のコメントを参照。
+
 検証
 - 期待出力: `Result: 0`（selfhost‑minimal）
 - スモーク：全成功（非 0 は失敗）