fix(mir): PHI検証panic修正 - update_cfg()を検証前に呼び出し

A案実装: debug_verify_phi_inputs呼び出し前にCFG predecessorを更新

修正箇所（7箇所）:
- src/mir/builder/phi.rs:50, 73, 132, 143
- src/mir/builder/ops.rs:273, 328, 351

根本原因:
- Branch/Jump命令でsuccessorは即座に更新
- predecessorはupdate_cfg()で遅延再構築
- PHI検証が先に実行されてpredecessor未更新でpanic

解決策:
- 各debug_verify_phi_inputs呼び出し前に
  if let Some(func) = self.current_function.as_mut() {
      func.update_cfg();
  }
  を挿入してCFGを同期

影響: if/else文、論理演算子(&&/||)のPHI生成が正常動作

lang/src/shared/json/utils/json_frag.hako

@@ -16,7 +16,7 @@ static box JsonFragBox {
     local pat1 = "\"" + key + "\":"
     local p = me.index_of_from(seg, pat1, 0)
     if p >= 0 {
-      local v = me.read_digits(seg, p + pat1.size())
+      local v = me.read_digits(seg, p + pat1.length())
       if v != "" { return me._str_to_int(v) }
     }
     return null
@@ -27,7 +27,7 @@ static box JsonFragBox {
     local pat = "\"" + key + "\":\""
     local p = me.index_of_from(seg, pat, 0)
     if p >= 0 {
-      local vstart = p + pat.size()              // start of value (right after opening quote)
+      local vstart = p + pat.length()              // start of value (right after opening quote)
       local vend = JsonCursorBox.scan_string_end(seg, vstart - 1)
       if vend > vstart { return seg.substring(vstart, vend) }
     }
@@ -57,10 +57,10 @@ static box JsonFragBox {
     if mjson == null { return "" }
     // Find the instructions array start reliably
     local key = "\"instructions\":["
-    local pk = call("String.indexOf/2", mjson, key)
+    local pk = mjson.indexOf(key)
     if pk < 0 { return "" }
     // '[' position
-    local arr_bracket = pk + key.size() - 1
+    local arr_bracket = pk + key.length() - 1
     // Use escape-aware scanner to find matching ']'
     local endp = JsonCursorBox.seek_array_end(mjson, arr_bracket)
     if endp < 0 { return "" }