Split boundary.sx: separate language contract from app-specific declarations

boundary.sx was mixing three concerns in one file:
- Core SX I/O primitives (the language contract)
- Deployment-specific layout I/O (app architecture)
- Per-service page helpers (fully app-specific)

Now split into three tiers:
1. shared/sx/ref/boundary.sx — core I/O only (frag, query, current-user, etc.)
2. shared/sx/ref/boundary-app.sx — deployment layout contexts (*-header-ctx, *-ctx)
3. {service}/sx/boundary.sx — per-service page helpers

The boundary parser loads all three tiers automatically. Validation error
messages now point to the correct file for each tier.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

shared/sx/boundary.py

@@ -69,22 +69,25 @@ def validate_primitive(name: str) -> None:
 
 
 def validate_io(name: str) -> None:
-    """Validate that an I/O primitive is declared in boundary.sx."""
+    """Validate that an I/O primitive is declared in boundary.sx or boundary-app.sx."""
     _load_declarations()
     assert _DECLARED_IO is not None
     if name not in _DECLARED_IO:
-        _report(f"Undeclared I/O primitive: {name!r}. Add to boundary.sx.")
+        _report(
+            f"Undeclared I/O primitive: {name!r}. "
+            f"Add to boundary.sx (core) or boundary-app.sx (deployment)."
+        )
 
 
 def validate_helper(service: str, name: str) -> None:
-    """Validate that a page helper is declared in boundary.sx."""
+    """Validate that a page helper is declared in {service}/sx/boundary.sx."""
     _load_declarations()
     assert _DECLARED_HELPERS is not None
     svc_helpers = _DECLARED_HELPERS.get(service, frozenset())
     if name not in svc_helpers:
         _report(
             f"Undeclared page helper: {name!r} for service {service!r}. "
-            f"Add to boundary.sx."
+            f"Add to {service}/sx/boundary.sx."
         )