builder/vm: stabilize json_lint_vm under unified calls

- Fix condition_fn resolution: Value call path + dev safety + stub injection
- VM bridge: handle Method::birth via BoxCall; ArrayBox push/get/length/set direct bridge
- Receiver safety: pin receiver in method_call_handlers to avoid undefined use across blocks
- Local vars: materialize on declaration (use init ValueId; void for uninit)
- Prefer legacy BoxCall for Array/Map/String/user boxes in emit_box_or_plugin_call (stability-first)
- Test runner: update LLVM hint to llvmlite harness (remove LLVM_SYS_180_PREFIX guidance)
- Docs/roadmap: update CURRENT_TASK with unified default-ON + guards

Note: NYASH_DEV_BIRTH_INJECT_BUILTINS=1 can re-enable builtin birth() injection during migration.

src/mir/builder/observe/ssa.rs

@@ -0,0 +1,43 @@
+use super::super::{BasicBlockId, MirBuilder, ValueId};
+
+/// Emit a dev‑only JSONL event for a PHI decision.
+/// Computes predecessor meta（type/origin）from the builder’s current maps.
+pub(crate) fn emit_phi(builder: &MirBuilder, dst: ValueId, inputs: &Vec<(BasicBlockId, ValueId)>) {
+    // Respect env gates in hub; just build meta here.
+    let preds: Vec<serde_json::Value> = inputs
+        .iter()
+        .map(|(bb, v)| {
+            let t = builder.value_types.get(v).cloned();
+            let o = builder.value_origin_newbox.get(v).cloned();
+            serde_json::json!({
+                "bb": bb.0,
+                "v": v.0,
+                "type": t.as_ref().map(|tt| format!("{:?}", tt)).unwrap_or_default(),
+                "origin": o.unwrap_or_default(),
+            })
+        })
+        .collect();
+    let decided_t = builder
+        .value_types
+        .get(&dst)
+        .cloned()
+        .map(|tt| format!("{:?}", tt))
+        .unwrap_or_default();
+    let decided_o = builder
+        .value_origin_newbox
+        .get(&dst)
+        .cloned()
+        .unwrap_or_default();
+    let meta = serde_json::json!({
+        "dst": dst.0,
+        "preds": preds,
+        "decided_type": decided_t,
+        "decided_origin": decided_o,
+    });
+    let fn_name = builder
+        .current_function
+        .as_ref()
+        .map(|f| f.signature.name.as_str());
+    let region = builder.debug_current_region_id();
+    crate::debug::hub::emit("ssa", "phi", fn_name, region.as_deref(), meta);
+}