builder/vm: stabilize json_lint_vm under unified calls

- Fix condition_fn resolution: Value call path + dev safety + stub injection
- VM bridge: handle Method::birth via BoxCall; ArrayBox push/get/length/set direct bridge
- Receiver safety: pin receiver in method_call_handlers to avoid undefined use across blocks
- Local vars: materialize on declaration (use init ValueId; void for uninit)
- Prefer legacy BoxCall for Array/Map/String/user boxes in emit_box_or_plugin_call (stability-first)
- Test runner: update LLVM hint to llvmlite harness (remove LLVM_SYS_180_PREFIX guidance)
- Docs/roadmap: update CURRENT_TASK with unified default-ON + guards

Note: NYASH_DEV_BIRTH_INJECT_BUILTINS=1 can re-enable builtin birth() injection during migration.

tools/llvmlite_harness.py

@@ -17,7 +17,18 @@ import os
 import sys
 from pathlib import Path
 
-ROOT = Path(__file__).resolve().parents[1]
+_default_root = Path(__file__).resolve().parents[1]
+_env_root = None
+try:
+    env_root_str = os.environ.get('NYASH_ROOT')
+    if env_root_str:
+        cand = Path(env_root_str).resolve()
+        if (cand / "src" / "llvm_py" / "llvm_builder.py").exists():
+            _env_root = cand
+except Exception:
+    _env_root = None
+
+ROOT = _env_root or _default_root
 PY_BUILDER = ROOT / "src" / "llvm_py" / "llvm_builder.py"
 
 def run_dummy(out_path: str) -> None: