Add regression suite testing JaySynth's TODO.md findings via testhost

tools/testhost/tests/run_tests.sh dynamically exercises the tracked
hardening findings using testhost itself - no GUI, sub-second wall
time:

- oversized_blocksize (Critical #5): --blockSize 16384 under a
  timeout, catching either the overflow or the deadlock the original
  bug could cause.
- nrpn_out_of_range/nrpn_in_range (Critical #1): JSON scenarios
  sending the 5-message MIDI NRPN CC sequence, once targeting the
  max 14-bit ID (16383) and once a legitimate in-range ID (500), so
  a regression that made the bounds check too aggressive would also
  show up.
- patch_save_load_roundtrip / bank_save_load_roundtrip: save a
  distinctive continuous parameter value, reload in a fresh process,
  check it round-trips within tolerance - covers the
  setCurrentProgramStateInformation no-op bug and the
  patchDecodeXml/patchImportXml fixes.
- stability_sweep: loads every bundled .fxp under extras/sounds/ and
  renders a held note through each, as a broad crash/NaN net.

Added --printParams to main.cpp (prints every parameter's index and
value) to make the round-trip tests possible - this was also already
a noted nice-to-have in testhost/TODO.md.

While building the oversized_blocksize test, found and fixed (on the
hardening branch, commit d713ca5) a second, previously-unknown bug:
VCF_CalcCoeff_LPF/_HPF/_BPF advance the coefficient buffer pointer
once per (sample, filter-section) pair, but the buffer was only ever
allocated for bufsize samples, not bufsize*sections - a 4th-order
filter overflowed it for any block between 4097 and 8192 samples.
Found via bisecting the crashing block size then confirming with an
ASan build; see tests/README.md's debugging-notes section for exactly
how, including the ASan symbolizer hang encountered along the way and
the workaround.

Also discovered (documented in tools/testhost/TODO.md's Investigate
section, not fixed - out of scope): JaySynth's compiled VST2 wrapper
never advertises chunk support to the host, so real .fxp/.fxb sample
files have no effect when loaded through the generic AudioProcessor
state API. The round-trip tests work around this by using testhost's
own save output as the fixture rather than an external sample file.

All 10 checks pass against the current hardening-branch build.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011dhtwRLARk4eiPngcQykLJ

tools/testhost/TODO.md

@@ -47,6 +47,22 @@ verified (PR https://git.jayfield.org/jens/JaySynth/pulls/1).
 
 ## Investigate
 
+- [ ] **JaySynth's compiled VST2 wrapper never advertises chunk support to
+  the host, so real `.fxp`/`.fxb` sample files silently have no effect when
+  loaded generically.** Found while building `tests/run_tests.sh`: loading
+  a bundled sample under `extras/sounds/` via `--patch` produces byte-
+  identical output to not loading anything (confirmed by diffing
+  `--printParams`). The files are legitimately in VST2's opaque-chunk
+  ("FPCh") format, but JUCE 3.1.1's plugin-side VST wrapper
+  (`juce_VST_Wrapper.cpp`, compiled into `JaySynth.so`) never sets
+  `effFlagsProgramChunks` on the `AEffect` struct, so JUCE's own host-side
+  `VSTPluginInstance::usesChunks()` returns false and silently no-ops both
+  load and save. Not one of the tracked `TODO.md` (repo root) findings, and
+  not attempted here - fixing it means patching JUCE's own VST wrapper,
+  a bigger and riskier change than this pass's scope. See
+  `tests/README.md` for the full writeup; `tests/run_tests.sh`'s round-trip
+  tests work around it by using `testhost`'s own save output as the
+  fixture instead of an external sample file.
 - [ ] **DPF-based plugins print a non-fatal assertion on load.** All three
   Zam*-vst.so plugins tested (built with the DISTRHO Plugin Framework) print
   `assertion failure: "fIsActive" in .../DistrhoPluginInternal.hpp` during
@@ -67,6 +83,11 @@ verified (PR https://git.jayfield.org/jens/JaySynth/pulls/1).
 
 ## Nice-to-have (not planned, just noted)
 
-- [ ] A `--list-params` or similar introspection mode (print every
+- [x] A `--list-params` or similar introspection mode (print every
   parameter's index/name/current value) would help writing new scenario
   JSON files without cross-referencing the plugin's own GUI or source.
+  Done: `--printParams` (prints `PARAM <index> <value>` for every
+  parameter, after any initial `--patch`/`--bank` load) - added to make
+  the patch/bank round-trip regression tests in `tests/` possible; only
+  prints values, not names, so cross-referencing the plugin's own
+  parameter-name list is still occasionally needed.