tooling: per-suite conformance filter + live-check.sh; note render-diff to vm-extensions

- conformance.sh [suite] runs ONE suite (filters the SUITES array so result-parser
  indices stay aligned; all MODULES still load). 'conformance.sh sxtp' = 0.3s vs ~8min.
- lib/host/live-check.sh: non-browser live smoke — boot ephemeral host, login, seed a
  post (exercises form-ingest write), print status|content-type|body-head per path,
  assert reads are text/sx + no JSON leak + no 5xx. The counterpart to run-picker-check.sh.
- plans/NOTE-render-diff-for-vm-ext.md: defer host_render_diff (JIT-vs-interpreter
  regression oracle) to the sx-vm-extensions loop — it's their fix's oracle, not a host
  feature; building it from loops/host would fork JIT-engine understanding.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

lib/host/conformance.sh

@@ -4,8 +4,11 @@
 # sx_server process, then reports pass/fail per suite. Mirrors lib/dream's runner.
 #
 # Usage:
-#   bash lib/host/conformance.sh        # run all suites
-#   bash lib/host/conformance.sh -v     # verbose (list each suite)
+#   bash lib/host/conformance.sh            # run all suites
+#   bash lib/host/conformance.sh sxtp       # run ONLY the sxtp suite (fast — skips
+#                                           # the Datalog-heavy blog suite)
+#   bash lib/host/conformance.sh blog -v    # one suite, verbose
+#   bash lib/host/conformance.sh -v         # all suites, verbose
 
 set -uo pipefail
 cd "$(git rev-parse --show-toplevel)"
@@ -19,7 +22,15 @@ if [ ! -x "$SX_SERVER" ]; then
   exit 1
 fi
 
-VERBOSE="${1:-}"
+# Args: an optional suite NAME runs just that suite (fast); -v is verbose per-suite.
+VERBOSE=""
+SUITE_FILTER=""
+for arg in "$@"; do
+  case "$arg" in
+    -v|--verbose) VERBOSE="-v" ;;
+    *) SUITE_FILTER="$arg" ;;
+  esac
+done
 
 # Kernel + subsystem dependencies, then the host modules. Order matters:
 # stdlib/r7rs first; the Datalog engine + ACL subsystem (authorisation); the feed
@@ -101,6 +112,22 @@ SUITES=(
   "ledger      host-lg-tests-run!  lib/host/tests/ledger.sx"
 )
 
+# Filter to a single suite if a name was given (filter the array itself so its
+# indices stay aligned with the result-parsing loop below). All MODULES still load
+# — the host modules are interdependent; only the TEST suites are narrowed.
+if [ -n "$SUITE_FILTER" ]; then
+  _FILTERED=()
+  for SUITE in "${SUITES[@]}"; do
+    [ "$(echo "$SUITE" | awk '{print $1}')" = "$SUITE_FILTER" ] && _FILTERED+=("$SUITE")
+  done
+  if [ "${#_FILTERED[@]}" -eq 0 ]; then
+    echo "ERROR: no suite named '$SUITE_FILTER'. Valid names:" >&2
+    for SUITE in "${SUITES[@]}"; do echo "  $(echo "$SUITE" | awk '{print $1}')" >&2; done
+    exit 1
+  fi
+  SUITES=("${_FILTERED[@]}")
+fi
+
 TMPFILE=$(mktemp); trap "rm -f $TMPFILE" EXIT
 EPOCH=1
 emit_load () { echo "(epoch $EPOCH)"; echo "(load \"$1\")"; EPOCH=$((EPOCH+1)); }