OCaml raw! in HTML renderer + SX_USE_OCAML env promotion + golden tests

- sx_render.ml: add raw! handler to HTML renderer (inject pre-rendered
  content without HTML escaping)
- docker-compose.yml: move SX_USE_OCAML/SX_OCAML_BIN to shared env
  (available to all services, not just sx_docs)
- hosts/ocaml/Dockerfile: OCaml kernel build stage
- shared/sx/tests/: golden test data + generator for OCaml render tests

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

hosts/ocaml/Dockerfile

@@ -0,0 +1,25 @@
+# OCaml SX kernel build image.
+#
+# Produces a statically-linked sx_server binary that can be COPY'd
+# into any service's Docker image.
+#
+# Usage:
+#   docker build -t sx-kernel -f hosts/ocaml/Dockerfile .
+#   docker build --target=export -o hosts/ocaml/_build/export -f hosts/ocaml/Dockerfile .
+
+FROM ocaml/opam:debian-12-ocaml-5.2 AS build
+
+USER opam
+WORKDIR /home/opam/sx
+
+# Copy only what's needed for the OCaml build
+COPY --chown=opam:opam hosts/ocaml/dune-project ./
+COPY --chown=opam:opam hosts/ocaml/lib/ ./lib/
+COPY --chown=opam:opam hosts/ocaml/bin/ ./bin/
+
+# Build the server binary
+RUN eval $(opam env) && dune build bin/sx_server.exe
+
+# Export stage — just the binary
+FROM scratch AS export
+COPY --from=build /home/opam/sx/_build/default/bin/sx_server.exe /sx_server

hosts/ocaml/lib/sx_render.ml

@@ -205,6 +205,12 @@ and render_list_to_html head args env =
   match head with
   | Symbol "<>" ->
     render_children args env
+  | Symbol "raw!" ->
+    (* Inject pre-rendered HTML without escaping *)
+    let v = Sx_ref.eval_expr (List.hd args) (Env env) in
+    (match v with
+     | String s | RawHTML s -> s
+     | _ -> value_to_string v)
   | Symbol tag when is_html_tag tag ->
     render_html_element tag args env
   | Symbol "if" ->