feat(compiler): make outputs write-only with live input references

[thiremani]

Declared outputs are write-only inside their template. A caller can explicitly share an input with an output by reusing the same binding; later input reads observe earlier output writes in both ordinary and ranged calls. This replaces the seed-read analysis proposed in the closed #102 and fixes #103.

Behavior

For out, seen = Fold(current, item), statement order determines what seen receives:

Body order	Plain call from 10 with item 5	Ranged call from 10 with items 1:3
seen = current, then out = current + item	15 10	13 11
out = current + item, then seen = current	15 15	13 13

An unaliased input keeps its own value. Sharing stays inside the call's staged result slots: sibling right-hand sides still read the caller's pre-assignment values. Empty ranges and skipped writes preserve existing destinations; fresh destinations start at zero.

What master did. Ordinary calls returned 15 10 for both body orders, while ranged calls returned 13 13 for the output-first body and 15 15 for a one-element range 5:6: the same read observed different values depending on whether the argument was 5 or a range containing only 5. Master's documented rule was the pre-call snapshot for ordinary calls; the live behavior in ranged variants was an artifact of routing the input to the output's staged slot. This PR removes that inconsistency by making every call follow the live-reference rule; the earlier commits on this branch had resolved it the other way, toward the snapshot.

Contract. Inputs cannot be assigned through their input names. Writing a shared output changes what subsequent input reads observe. Every simultaneous assignment evaluates its reads before applying its writes, inside a body as at the call site, so out, before = current + item, current still gives before the prior value. Keeping an old value across a write is an explicit assignment that creates an independent value; any copy it costs sits at that assignment.

With two shared inputs, sequential a = y then b = x produces 2 2 from 1 2. Simultaneous a, b = y, x swaps them to 2 1.

Output-name reads remain errors, including conditions, arguments, prints, and formatting markers. Inputs are read-only bindings, so %n writes into an input or iterator parameter are now rejected; acc_fmt uses a writable local copy.

Implementation and migration

• Remove per-iteration input snapshots. Whether an argument shares a binding with a destination is decided at compile time from the call's names and lowered as a private variant of the specialization (internal linkage) named with the mangling scheme's marker-plus-count suffixes, _aN_<slots> for the alias pattern and _oN_<types> for widened output storage, both demangled by Demangle: inside it a direct scalar input reads the output's current value and a compatible indirect input receives the staged output pointer. Nested calls and caller-driven ranges forward sharing by name through the same alias bindings, so there are no hidden arguments, no run-time selects, and no pointer comparisons.
• Specialize binding arguments on settled storage types and revisit calls after storage widening. Private output-storage variants preserve sharing across compatible ownership or array-shape representations. This fixes the static-to-heap and nested refinement cases in Call arguments are specialized on the binding's flow type, not its merged slot type #103.
• CFG liveness is exact per alias context. Settlement analyzes each type specialization's unshared context; the script walk derives each call's context from names, forwards it through nested calls by the rule lowering uses (one shared function, aliasPattern, with the body's outputs bound to the storage the enclosing call widened them to), visits each lowered variant once, analyzes shared contexts on first reach, and caches them on the specialization by alias pattern. A read of a shared input counts as a read of its output's latest write, so out = current + item written twice is accepted when called as value = BumpTwice(value, 5) and reported as an unused overwrite when called as other = BumpTwice(value, 5). Local copies retain their own binding permissions.
• Native ABI 2.1: exported prototypes carry no alias selectors: a direct-return function is (params..., seed) and an indirect-return function keeps its leading result carrier followed by params..., with no seed. Functions without a range parameter are unchanged from master. Range-bearing functions on master carried a hidden i32 alias selector per direct scalar parameter before the seed; those selectors are removed, so their prototype changes and the seed moves one position earlier. This is a documented break in the C ABI spec ("Changes in 2.1"); there are no shipped native callers. An intermediate revision of this PR had instead added selectors to every function and resolved aliasing at run time, which cost about 10% on fib_tail.
• Native pointer sharing holds within the called body's own statements; a nested Pluto call inside it stages its outputs, so it does not extend the sharing to a native caller. Pluto callers get sharing across nested calls statically. Documented in the spec; a generic pointer entry that resolves unknown sharing at run time, beside the private variants, is recorded as outstanding in the effects plan.
• Templates that previously read output names use locals or single expressions. The Rebuild rewrite in this PR changes [26] to [37] and [2] to [6]. Live sharing also changes mem_alias_refine from Sibling: hello! to Sibling: static!.
• Preserve existing LLVM loop metadata when adding unroll hints (separate commit). It was required while the selector signatures changed the optimized Fib loop's shape; with the original prototypes restored it is a robustness fix and stays.

The memory model, README, ABI specifications, IR plan, and effects plan describe the final rule. The effects plan distinguishes the implemented %n input restriction from pending write-effect modeling.

Verification

• Race-enabled lexer, parser, compiler, and root tests pass; go vet ./... passes.
• Full suite: 76 passed, 0 failed; all 75 runtime leak checks report zero leaks.
• Existing fixtures cover both Fold orders, ownership, nested sharing, conditional writes, array resets, and caller-side staging. The only additional behavior pair from review is sequential versus simultaneous swap.
• IR tests cover the array-copy regressions, the alias variant reading its output's storage, an unaliased call using the public specialization, and a variant skipping an incompatible output; metadata tests cover preservation, explicit policies, and idempotence.
• Benchmarks against master (bench repo fib, fib_tail, harmonic; median of 10 with 5 warm-ups, native CPU, output parity checked): fib 0.97x, fib_tail 1.01x, harmonic 1.01x. With the earlier run-time selectors fib_tail was 1.10x slower (stable across three re-runs); restoring the plain prototype through compile-time variants recovered it.