aser_slot migration: single-pass expansion, pipe desync fix, _render_to_sx

Three fixes completing the aser_slot migration:

1. Single-pass full-page rendering: eval_sx_url builds layout+content
   AST and aser_slots it in ONE call — avoids double-aser where
   re-parsed content hits "Undefined symbol: title/deref" errors.

2. Pipe desync fix: _inject_helpers_locked runs INSIDE the aser_slot
   lock acquisition (not as a separate lock). Prevents interleaved
   commands from other coroutines between injection and aser-slot.

3. _render_to_sx uses aser_slot (not aser): layout wrappers like
   oob_page_sx contain re-parsed content from earlier aser_slot
   calls. Regular aser fails on symbols that were bound during
   the earlier expansion. aser_slot handles them correctly.

HTMX path: aser_slot the content, then oob_page_sx wraps it.
Full page path: build (~shared:layout/app-body :content wrapped_ast),
aser_slot in one pass, pass directly to sx_page.

New Playwright tests: test_navigate_geography_to_reactive,
test_direct_load_reactive_page.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

shared/static/scripts/sx-browser.js

@@ -14,7 +14,7 @@
   // =========================================================================
 
   var NIL = Object.freeze({ _nil: true, toString: function() { return "nil"; } });
-  var SX_VERSION = "2026-03-19T12:40:33Z";
+  var SX_VERSION = "2026-03-19T14:05:23Z";
 
   function isNil(x) { return x === NIL || x === null || x === undefined; }
   function isSxTruthy(x) { return x !== false && !isNil(x); }