Enforce SX boundary contract via boundary.sx spec + runtime validation

Add boundary.sx declaring all 34 I/O primitives, 32 page helpers, and 9
allowed boundary types. Runtime validation in boundary.py checks every
registration against the spec — undeclared primitives/helpers crash at
startup with SX_BOUNDARY_STRICT=1 (now set in both dev and prod).

Key changes:
- Move 5 I/O-in-disguise primitives (app-url, asset-url, config,
  jinja-global, relations-from) from primitives.py to primitives_io.py
- Remove duplicate url-for/route-prefix from primitives.py (already in IO)
- Fix parse-datetime to return ISO string instead of raw datetime
- Add datetime→isoformat conversion in _convert_result at the edge
- Wrap page helper return values with boundary type validation
- Replace all SxExpr(f"...") patterns with sx_call() or _sx_fragment()
- Add assert declaration to primitives.sx

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

shared/sx/ref/cssx.sx

@@ -185,7 +185,10 @@
 
                           (cond
                             (nil? variant)
-                              (append! base-decls decls)
+                              (if (is-child-selector-atom? base)
+                                (append! pseudo-rules
+                                  (list ">:not(:first-child)" decls))
+                                (append! base-decls decls))
 
                             (dict-has? _responsive-breakpoints variant)
                               (append! media-rules
@@ -222,23 +225,23 @@
                 (fn (mr)
                   (set! hash-input
                     (str hash-input "@" (first mr) "{" (nth mr 1) "}")))
-                (chunk-every media-rules 2))
+                media-rules)
               (for-each
                 (fn (pr)
                   (set! hash-input
                     (str hash-input (first pr) "{" (nth pr 1) "}")))
-                (chunk-every pseudo-rules 2))
+                pseudo-rules)
               (for-each
                 (fn (kf)
                   (set! hash-input (str hash-input (nth kf 1))))
-                (chunk-every kf-needed 2))
+                kf-needed)
 
               (let ((cn (str "sx-" (hash-style hash-input)))
                     (sv (make-style-value cn
                           (join ";" base-decls)
-                          (chunk-every media-rules 2)
-                          (chunk-every pseudo-rules 2)
-                          (chunk-every kf-needed 2))))
+                          media-rules
+                          pseudo-rules
+                          kf-needed)))
                 (dict-set! _style-cache key sv)
                 ;; Inject CSS rules
                 (inject-style-value sv atoms)