Enforce SX boundary contract via boundary.sx spec + runtime validation

Add boundary.sx declaring all 34 I/O primitives, 32 page helpers, and 9
allowed boundary types. Runtime validation in boundary.py checks every
registration against the spec — undeclared primitives/helpers crash at
startup with SX_BOUNDARY_STRICT=1 (now set in both dev and prod).

Key changes:
- Move 5 I/O-in-disguise primitives (app-url, asset-url, config,
  jinja-global, relations-from) from primitives.py to primitives_io.py
- Remove duplicate url-for/route-prefix from primitives.py (already in IO)
- Fix parse-datetime to return ISO string instead of raw datetime
- Add datetime→isoformat conversion in _convert_result at the edge
- Wrap page helper return values with boundary type validation
- Replace all SxExpr(f"...") patterns with sx_call() or _sx_fragment()
- Add assert declaration to primitives.sx

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

shared/sx/pages.py

@@ -79,9 +79,34 @@ def register_page_helpers(service: str, helpers: dict[str, Any]) -> None:
           :auth :public
           :content (docs-content slug))
     """
+    from .boundary import validate_helper, validate_boundary_value
+    import asyncio
+    import functools
+
+    for name in helpers:
+        validate_helper(service, name)
+
+    # Wrap helpers to validate return values at the boundary
+    wrapped: dict[str, Any] = {}
+    for name, fn in helpers.items():
+        if asyncio.iscoroutinefunction(fn):
+            @functools.wraps(fn)
+            async def _async_wrap(*a, _fn=fn, _name=name, **kw):
+                result = await _fn(*a, **kw)
+                validate_boundary_value(result, context=f"helper {_name!r}")
+                return result
+            wrapped[name] = _async_wrap
+        else:
+            @functools.wraps(fn)
+            def _sync_wrap(*a, _fn=fn, _name=name, **kw):
+                result = _fn(*a, **kw)
+                validate_boundary_value(result, context=f"helper {_name!r}")
+                return result
+            wrapped[name] = _sync_wrap
+
     if service not in _PAGE_HELPERS:
         _PAGE_HELPERS[service] = {}
-    _PAGE_HELPERS[service].update(helpers)
+    _PAGE_HELPERS[service].update(wrapped)
 
 
 def get_page_helpers(service: str) -> dict[str, Any]: