Core neg smokes: Array OOB get/set tags (set accepts null), Map missing key; Bridge canonicalize diff test (opt-in) with mutated JSON dump; Selfhost: apply child_env OOB strict guard around VM exec; Core bridge supports dump-mut env.

src/runner/modes/common_util/core_bridge.rs

@@ -42,6 +42,14 @@ pub fn canonicalize_module_json(input: &str) -> Result<String, String> {
         if mutated {
             output = serde_json::to_string(&json)
                 .map_err(|e| format!("bridge canonicalize: serialize error ({})", e))?;
+            // Optional: dump mutated JSON for diff-based tests
+            if let Ok(path) = env::var("HAKO_DEBUG_NYVM_BRIDGE_DUMP_MUT") {
+                if !path.trim().is_empty() {
+                    if let Err(e) = fs::write(&path, output.as_bytes()) {
+                        eprintln!("[bridge/dump-mut] write error: {}", e);
+                    }
+                }
+            }
         }
     }