HS tests: VM step limit fix, callFn error propagation, compiler emit-set fixes

- sx_vm.ml: VM timeout now compares vm_insn_count > step_limit instead of
  unconditionally throwing after 65536 instructions when limit > 0
- sx_browser.ml: Expose setStepLimit/resetStepCount APIs on SxKernel;
  callFn now returns {__sx_error, message} on Eval_error instead of null
- compiler.sx: emit-set handles array-index targets (host-set! instead of
  nth) and 'of' property chains (dom-set-prop with chain navigation)
- hs-run-fast.js: New Node.js test runner with step-limit timeouts,
  SX-level guard for error detection, insertAdjacentHTML mock,
  range selection (HS_START/HS_END), wall-clock timeout in driveAsync
- hs-debug-test.js: Single-test debugger with DOM state inspection
- hs-verify.js: Assertion verification (proves pass/fail detection works)

Test results: 415/831 (50%), up from 408/831 (49%) baseline.
Fixes: set my style["color"], set X of Y, put at end of (insertAdjacentHTML).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

hosts/ocaml/lib/sx_vm.ml

@@ -448,8 +448,9 @@ and run vm =
         let op = bc.(frame.ip) in
         frame.ip <- frame.ip + 1;
         incr _vm_insn_count;
-        (* Check timeout flag set by SIGALRM *)
-        if !_vm_insn_count land 0xFFFF = 0 && !Sx_ref.step_limit > 0 then
+        (* Check timeout — compare VM instruction count against step limit *)
+        if !_vm_insn_count land 0xFFFF = 0 && !Sx_ref.step_limit > 0
+           && !_vm_insn_count > !Sx_ref.step_limit then
           raise (Eval_error "TIMEOUT: step limit exceeded");
         (try match op with
         (* ---- Constants ---- *)