public: publish selfhost snapshot to public repo (SSOT using + AST merge + JSON VM fixes)

- SSOT using profiles (aliases/packages via nyash.toml), AST prelude merge
- Parser/member guards; Builder pin/PHI and instance→function rewrite (dev on)
- VM refactors (handlers split) and JSON roundtrip/nested stabilization
- CURRENT_TASK.md updated with scope and acceptance criteria

Notes: dev-only guards remain togglable via env; no default behavior changes for prod.

src/config/env.rs

@@ -358,12 +358,11 @@ pub fn using_is_ci() -> bool { using_profile().eq_ignore_ascii_case("ci") }
 pub fn using_is_dev() -> bool { using_profile().eq_ignore_ascii_case("dev") }
 /// Allow `using "path"` statements in source (dev-only by default).
 pub fn allow_using_file() -> bool {
-    if using_is_prod() { return false; }
-    // Optional explicit override
+    // SSOT 徹底: 全プロファイルで既定禁止（nyash.toml を唯一の真実に）
+    // 明示オーバーライドでのみ許可（開発用緊急時）
     match std::env::var("NYASH_ALLOW_USING_FILE").ok().as_deref() {
-        Some("0") | Some("false") | Some("off") => false,
         Some("1") | Some("true") | Some("on") => true,
-        _ => true, // dev/ci default: allowed
+        _ => false,
     }
 }
 /// Determine whether AST prelude merge for `using` is enabled.