builder/vm: stabilize json_lint_vm under unified calls

- Fix condition_fn resolution: Value call path + dev safety + stub injection
- VM bridge: handle Method::birth via BoxCall; ArrayBox push/get/length/set direct bridge
- Receiver safety: pin receiver in method_call_handlers to avoid undefined use across blocks
- Local vars: materialize on declaration (use init ValueId; void for uninit)
- Prefer legacy BoxCall for Array/Map/String/user boxes in emit_box_or_plugin_call (stability-first)
- Test runner: update LLVM hint to llvmlite harness (remove LLVM_SYS_180_PREFIX guidance)
- Docs/roadmap: update CURRENT_TASK with unified default-ON + guards

Note: NYASH_DEV_BIRTH_INJECT_BUILTINS=1 can re-enable builtin birth() injection during migration.

src/mir/builder/utils.rs

@@ -76,31 +76,31 @@ impl super::MirBuilder {
         args: Vec<super::ValueId>,
         effects: super::EffectMask,
     ) -> Result<(), String> {
-        // Check environment variable for unified call usage
-        let use_unified = std::env::var("NYASH_MIR_UNIFIED_CALL")
-            .unwrap_or_else(|_| "0".to_string()) != "0";
-
-        if use_unified {
-            // Use unified call emission for BoxCall
-            // First, try to determine the box type
-            let mut box_type: Option<String> = self.value_origin_newbox.get(&box_val).cloned();
-            if box_type.is_none() {
-                if let Some(t) = self.value_types.get(&box_val) {
-                    match t {
-                        super::MirType::String => box_type = Some("StringBox".to_string()),
-                        super::MirType::Box(name) => box_type = Some(name.clone()),
-                        _ => {}
-                    }
+        // Check environment variable for unified call usage, with safe overrides for core/user boxes
+        let use_unified_env = super::calls::call_unified::is_unified_call_enabled();
+        // First, try to determine the box type
+        let mut box_type: Option<String> = self.value_origin_newbox.get(&box_val).cloned();
+        if box_type.is_none() {
+            if let Some(t) = self.value_types.get(&box_val) {
+                match t {
+                    super::MirType::String => box_type = Some("StringBox".to_string()),
+                    super::MirType::Box(name) => box_type = Some(name.clone()),
+                    _ => {}
                 }
             }
-
-            // Use emit_unified_call with Method target
+        }
+        // Prefer legacy BoxCall for core collection boxes and user instance boxes (stability first)
+        let prefer_legacy = match box_type.as_deref() {
+            Some("ArrayBox") | Some("MapBox") | Some("StringBox") => true,
+            Some(bt) => !bt.ends_with("Box"), // user instance class name (e.g., JsonTokenizer)
+            None => false,
+        };
+        if use_unified_env && !prefer_legacy {
             let target = super::builder_calls::CallTarget::Method {
                 box_type,
                 method: method.clone(),
                 receiver: box_val,
             };
-
             return self.emit_unified_call(dst, target, args);
         }