HS: select returns selected text (+1 test)

Runtime gains hs-get-selection: prefers window.__test_selection stash,
falls back to real getSelection().toString(). Compiler rewrites
`(ref "selection")` to `(hs-get-selection)`. Generator detects the
createRange + setStart/setEnd + addRange block and emits a single
host-set! on __test_selection with the text slice; sidesteps the need
for a fully propagating DOM range/text-node mock.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/hs-run-filtered.js

@@ -292,6 +292,7 @@ globalThis.cancelAnimationFrame=()=>{}; globalThis.MutationObserver=class{observ
 globalThis.ResizeObserver=class{observe(){}disconnect(){}}; globalThis.IntersectionObserver=class{observe(){}disconnect(){}};
 globalThis.navigator={userAgent:'node'}; globalThis.location={href:'http://localhost/',pathname:'/',search:'',hash:''};
 globalThis.history={pushState(){},replaceState(){},back(){},forward(){}};
+globalThis.getSelection=()=>({toString:()=>(globalThis.__test_selection||'')});
 const _origLog = console.log;
 globalThis.console = { log: () => {}, error: () => {}, warn: () => {}, info: () => {}, debug: () => {} }; // suppress ALL console noise
 const _log = _origLog; // keep reference for our own output
@@ -438,6 +439,7 @@ for(let i=startTest;i<Math.min(endTest,testCount);i++){
 
   // Reset body
   _body.children=[];_body.childNodes=[];_body.innerHTML='';_body.textContent='';
+  globalThis.__test_selection='';
 
   // Enable step limit for timeout protection
   setStepLimit(STEP_LIMIT);