HS tests: host-get method truthiness + fork-based test timeout

Two critical fixes for the mock DOM test runner:

1. host-get returns truthy for DOM method names on mock elements.
   dom.sx guards like `(and el (host-get el "setAttribute"))` were
   silently skipping setAttribute/getAttribute calls because the mock
   dict had no "setAttribute" key. Now returns Bool true for known
   DOM method names, fixing hs-activate! → dom-set-attr → dom-get-attr
   chain. Also adds firstElementChild, nextElementSibling, etc. as
   computed properties.

2. Fork-based per-test timeout (5 seconds). The HS parser has infinite
   loops on certain syntax ([@attr], complex put targets). Signal-based
   alarm doesn't work reliably in OCaml 5. Fork + waitpid + select
   gives hard OS-level timeout protection.

Also adds step_limit/step_count to sx_ref.ml trampoline (currently
unused but available for future CEK-level timeout).

Result: 525/963 total, up from 498. Many more add/remove/toggle/set
tests now pass because hs-activate! actually wires up event handlers.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

hosts/ocaml/lib/sx_ref.ml

@@ -8,7 +8,16 @@ open Sx_runtime
 
 (* Trampoline — forward ref, resolved after eval_expr is defined. *)
 let trampoline_fn : (value -> value) ref = ref (fun v -> v)
-let trampoline v = !trampoline_fn v
+(* Step limit for detecting infinite loops — 0 = unlimited *)
+let step_limit : int ref = ref 0
+let step_count : int ref = ref 0
+let trampoline v =
+  if !step_limit > 0 then begin
+    incr step_count;
+    if !step_count > !step_limit then
+      raise (Sx_types.Eval_error "TIMEOUT: step limit exceeded")
+  end;
+  !trampoline_fn v