host: wire :body into live rendering — composition fold is fold #1, live (roadmap step 2)

A record may carry a :body (a composition node); host/blog-post renders it via the
render-fold (host/comp-render) against a context built from the principal (auth), else the
legacy sx_content path. compose.sx loaded into the host (serve.sh + conformance.sh module
lists). host/blog-body-of / host/blog--set-body!.

Seeded /compose-demo: ONE composition object that shows seq + alt(when auth) + row(par) +
each, and renders DIFFERENTLY by context. Verified live-path (ephemeral SX_SERVING_JIT=1):
anon -> login-prompt (else) + columns + event list; authed -> member block (when auth),
login-prompt gone. The object is the program; the render is the execution -- now live.
Focused eval confirms the in-process render matches the test (ANON<span>..> vs MEMBER<..>).
Tests added; full blog suite still box-contended.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

lib/host/tests/blog.sx

@@ -737,6 +737,19 @@
 (host-bl-test "POST /import rejects a non-list body -> 400"
   (dream-status (host-bl-wapp (host-bl-send "POST" "/import" "Bearer good" "text/sx" "{:x 1}")))
   400)
+
+;; -- composition objects: a record with :body renders via the render-fold --
+(host-bl-test "a record's :body renders via the fold, different per context"
+  (begin
+    (host/blog-put! "cdoc" "C" "(p \"fallback\")" "published")
+    (host/blog--set-body! "cdoc"
+      (quote (seq (alt (when (has "auth") (text "MEMBER")) (else (text "ANON")))
+                  (each (items {:name "X"} {:name "Y"}) (field :name)))))
+    (list (host/comp-render (host/blog-body-of "cdoc") {})
+          (host/comp-render (host/blog-body-of "cdoc") {"auth" "y"})))
+  (list "ANON<span>X</span><span>Y</span>" "MEMBER<span>X</span><span>Y</span>"))
+(host-bl-test "post page renders :body (composition) over sx_content"
+  (contains? (dream-resp-body (host-bl-app (host-bl-req "/cdoc/"))) "ANON") true)
 (host-bl-test "a post with no schema'd type is vacuously valid"
   (host/blog-type-valid? "ppost" "(p \"anything\")") true)
 (host-bl-test "edit-submit rejects content violating the type schema (not saved)"