Enforce SX boundary contract via boundary.sx spec + runtime validation

Add boundary.sx declaring all 34 I/O primitives, 32 page helpers, and 9
allowed boundary types. Runtime validation in boundary.py checks every
registration against the spec — undeclared primitives/helpers crash at
startup with SX_BOUNDARY_STRICT=1 (now set in both dev and prod).

Key changes:
- Move 5 I/O-in-disguise primitives (app-url, asset-url, config,
  jinja-global, relations-from) from primitives.py to primitives_io.py
- Remove duplicate url-for/route-prefix from primitives.py (already in IO)
- Fix parse-datetime to return ISO string instead of raw datetime
- Add datetime→isoformat conversion in _convert_result at the edge
- Wrap page helper return values with boundary type validation
- Replace all SxExpr(f"...") patterns with sx_call() or _sx_fragment()
- Add assert declaration to primitives.sx

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

sx/content/highlight.py

@@ -238,7 +238,7 @@ def _tokenize_bash(code: str) -> list[tuple[str, str]]:
 
 def highlight(code: str, language: str = "lisp"):
     """Highlight code in the given language. Returns SxExpr for wire format."""
-    from shared.sx.parser import SxExpr
+    from shared.sx.parser import SxExpr, serialize
     if language in ("lisp", "sx", "sexp"):
         return SxExpr(highlight_sx(code))
     elif language in ("python", "py"):
@@ -246,5 +246,4 @@ def highlight(code: str, language: str = "lisp"):
     elif language in ("bash", "sh", "shell"):
         return SxExpr(highlight_bash(code))
     # Fallback: no highlighting, just escaped text
-    escaped = code.replace("\\", "\\\\").replace('"', '\\"')
-    return SxExpr(f'(span "{escaped}")')
+    return SxExpr("(span " + serialize(code) + ")")