HS: +9 — when @attr changes via MutationObserver, def/default/empty no-step-limit (1494/1496)

T6 'attribute observers are persistent' fix:
- parser.sx: parse-when-feat accepts 'attr' token type alongside hat/local/dom
- compiler.sx: hs-to-sx for (when-changes (attr name target) body) emits
  (hs-attr-watch! target name (fn (it) body))
- runtime.sx: hs-attr-watch! creates a MutationObserver scoped to the target
  with attributes:true and attributeFilter:[name]; fires handler with the
  new attribute value on each change. Uses host-new "MutationObserver" so
  the test mock's HsMutationObserver intercepts.

Step-limit cascades:
- hs-upstream-default, hs-upstream-def, hs-upstream-empty added to
  NO_STEP_LIMIT_SUITES — these legitimately exceed the 1M default when
  scoped variable + array index ops cascade through eval-hs+JIT warmup.

All 110 hyperscript suites now green individually (per-suite runs).
The 2 remaining gap-tests are likely range-counting edge cases at
index boundaries — visible only in cross-range cumulative runs.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/hs-run-filtered.js

@@ -985,6 +985,10 @@ for(let i=startTest;i<Math.min(endTest,testCount);i++){
     "hs-upstream-expressions/collectionExpressions",
     "hs-upstream-expressions/typecheck",
     "hs-upstream-socket",
+    // these suites do scoped variable + array operations that cascade step counts
+    "hs-upstream-default",
+    "hs-upstream-def",
+    "hs-upstream-empty",
   ]);
   // Enable step limit for timeout protection — reset counter first so accumulation
   // across tests doesn't cause signed-32-bit wraparound (~2B extra steps before limit fires).