Phase 2: IO detection & selective expansion in deps.sx

Extend the spec with IO scanning functions (scan-io-refs, transitive-io-refs,
compute-all-io-refs, component-pure?) that detect IO primitive references in
component ASTs. Components are classified as pure (no IO deps, safe for client
rendering) or IO-dependent (must expand server-side).

The partial evaluator (_aser) now uses per-component IO metadata instead of
the global _expand_components toggle: IO-dependent components expand server-
side, pure components serialize for client. Layout slot context still expands
all components for backwards compat.

Spec: 5 new functions + 2 platform interface additions in deps.sx
Host: io_refs field + is_pure property on Component, compute_all_io_refs()
Bootstrap: both sx_ref.py and sx-ref.js updated with IO functions
Bundle analyzer: shows pure/IO classification per page

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

shared/sx/jinja_bridge.py

@@ -204,8 +204,9 @@ def register_components(sx_source: str) -> None:
             val.css_classes = set(all_classes)
 
     # Recompute transitive deps for all components (cheap — just AST walking)
-    from .deps import compute_all_deps
+    from .deps import compute_all_deps, compute_all_io_refs, get_all_io_names
     compute_all_deps(_COMPONENT_ENV)
+    compute_all_io_refs(_COMPONENT_ENV, get_all_io_names())
 
     _compute_component_hash()