Phase 2: IO detection & selective expansion in deps.sx

Extend the spec with IO scanning functions (scan-io-refs, transitive-io-refs,
compute-all-io-refs, component-pure?) that detect IO primitive references in
component ASTs. Components are classified as pure (no IO deps, safe for client
rendering) or IO-dependent (must expand server-side).

The partial evaluator (_aser) now uses per-component IO metadata instead of
the global _expand_components toggle: IO-dependent components expand server-
side, pure components serialize for client. Layout slot context still expands
all components for backwards compat.

Spec: 5 new functions + 2 platform interface additions in deps.sx
Host: io_refs field + is_pure property on Component, compute_all_io_refs()
Bootstrap: both sx_ref.py and sx-ref.js updated with IO functions
Bundle analyzer: shows pure/IO classification per page

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

shared/sx/types.py

@@ -168,6 +168,12 @@ class Component:
     closure: dict[str, Any] = field(default_factory=dict)
     css_classes: set[str] = field(default_factory=set)  # pre-scanned :class values
     deps: set[str] = field(default_factory=set)        # transitive component deps (~names)
+    io_refs: set[str] = field(default_factory=set)     # transitive IO primitive refs
+
+    @property
+    def is_pure(self) -> bool:
+        """True if this component has no transitive IO dependencies."""
+        return not self.io_refs
 
     def __repr__(self):
         return f"<Component ~{self.name}({', '.join(self.params)})>"