Phase 2: IO detection & selective expansion in deps.sx

Extend the spec with IO scanning functions (scan-io-refs, transitive-io-refs,
compute-all-io-refs, component-pure?) that detect IO primitive references in
component ASTs. Components are classified as pure (no IO deps, safe for client
rendering) or IO-dependent (must expand server-side).

The partial evaluator (_aser) now uses per-component IO metadata instead of
the global _expand_components toggle: IO-dependent components expand server-
side, pure components serialize for client. Layout slot context still expands
all components for backwards compat.

Spec: 5 new functions + 2 platform interface additions in deps.sx
Host: io_refs field + is_pure property on Component, compute_all_io_refs()
Bootstrap: both sx_ref.py and sx-ref.js updated with IO functions
Bundle analyzer: shows pure/IO classification per page

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

shared/sx/ref/bootstrap_js.py

@@ -502,9 +502,17 @@ class JSEmitter:
             "component-deps": "componentDeps",
             "component-set-deps!": "componentSetDeps",
             "component-css-classes": "componentCssClasses",
+            "component-io-refs": "componentIoRefs",
+            "component-set-io-refs!": "componentSetIoRefs",
             "env-components": "envComponents",
             "regex-find-all": "regexFindAll",
             "scan-css-classes": "scanCssClasses",
+            # deps.sx IO detection
+            "scan-io-refs": "scanIoRefs",
+            "scan-io-refs-walk": "scanIoRefsWalk",
+            "transitive-io-refs": "transitiveIoRefs",
+            "compute-all-io-refs": "computeAllIoRefs",
+            "component-pure?": "componentPure_p",
         }
         if name in RENAMES:
             return RENAMES[name]
@@ -1904,6 +1912,14 @@ PLATFORM_DEPS_JS = '''
     }
     return result;
   }
+
+  function componentIoRefs(c) {
+    return c.ioRefs ? c.ioRefs.slice() : [];
+  }
+
+  function componentSetIoRefs(c, refs) {
+    c.ioRefs = refs;
+  }
 '''
 
 PLATFORM_PARSER_JS = r"""
@@ -3081,6 +3097,10 @@ def public_api_js(has_html, has_sx, has_dom, has_engine, has_orch, has_cssx, has
         api_lines.append('    componentsNeeded: componentsNeeded,')
         api_lines.append('    pageComponentBundle: pageComponentBundle,')
         api_lines.append('    pageCssClasses: pageCssClasses,')
+        api_lines.append('    scanIoRefs: scanIoRefs,')
+        api_lines.append('    transitiveIoRefs: transitiveIoRefs,')
+        api_lines.append('    computeAllIoRefs: computeAllIoRefs,')
+        api_lines.append('    componentPure_p: componentPure_p,')
 
     api_lines.append(f'    _version: "{version}"')
     api_lines.append('  };')