feat(compiler): make outputs write-only with live input references

[thiremani]

Declared outputs are write-only inside their template. A caller can explicitly share an input with an output by reusing the same binding; later input reads observe earlier output writes in both ordinary and ranged calls. This replaces the seed-read analysis proposed in the closed #102 and fixes #103.

Behavior

For out, seen = Fold(current, item), statement order determines what seen receives:

Body order	Plain call from 10 with item 5	Ranged call from 10 with items 1:3
seen = current, then out = current + item	15 10	13 11
out = current + item, then seen = current	15 15	13 13

An unaliased input keeps its own value. Sharing stays inside the call's staged result slots: sibling right-hand sides still read the caller's pre-assignment values. Empty ranges and skipped writes preserve existing destinations; fresh destinations start at zero.

What master did. Ordinary calls returned 15 10 for both body orders, while ranged calls returned 13 13 for the output-first body and 15 15 for a one-element range 5:6: the same read observed different values depending on whether the argument was 5 or a range containing only 5. Master's documented rule was the pre-call snapshot for ordinary calls; the live behavior in ranged variants was an artifact of routing the input to the output's staged slot. This PR removes that inconsistency by making every call follow the live-reference rule; the earlier commits on this branch had resolved it the other way, toward the snapshot.

Contract. Inputs cannot be assigned through their input names. Writing a shared output changes what subsequent input reads observe. Every simultaneous assignment evaluates its reads before applying its writes, inside a body as at the call site, so out, before = current + item, current still gives before the prior value. Keeping an old value across a write is an explicit assignment that creates an independent value; any copy it costs sits at that assignment.

With two shared inputs, sequential a = y then b = x produces 2 2 from 1 2. Simultaneous a, b = y, x swaps them to 2 1.

Output-name reads remain errors, including conditions, arguments, prints, and formatting markers. Inputs are read-only bindings, so %n writes into an input or iterator parameter are now rejected; acc_fmt uses a writable local copy.

Implementation and migration

• Remove per-iteration input snapshots. Whether an argument shares a binding with a destination is decided at compile time from the call's names and lowered as a private variant of the specialization (internal linkage) named with the mangling scheme's marker-plus-count suffixes, _aN_<slots> for the alias pattern and _oN_<types> for widened output storage, both demangled by Demangle: inside it a direct scalar input reads the output's current value and a compatible indirect input receives the staged output pointer. Nested calls and caller-driven ranges forward sharing by name through the same alias bindings, so there are no hidden arguments, no run-time selects, and no pointer comparisons.
• Specialize binding arguments on settled storage types and revisit calls after storage widening. Private output-storage variants preserve sharing across compatible ownership or array-shape representations. This fixes the static-to-heap and nested refinement cases in Call arguments are specialized on the binding's flow type, not its merged slot type #103.
• Preserve prior output writes in CFG liveness when an explicit compatible input can observe them. Local copies retain their own binding permissions.
• Native ABI 2.1: exported prototypes carry no alias selectors: a direct-return function is (params..., seed) and an indirect-return function keeps its leading result carrier followed by params..., with no seed. Functions without a range parameter are unchanged from master. Range-bearing functions on master carried a hidden i32 alias selector per direct scalar parameter before the seed; those selectors are removed, so their prototype changes and the seed moves one position earlier. This is a documented break in the C ABI spec ("Changes in 2.1"); there are no shipped native callers. An intermediate revision of this PR had instead added selectors to every function and resolved aliasing at run time, which cost about 10% on fib_tail.
• Native pointer sharing holds within the called body's own statements; a nested Pluto call inside it stages its outputs, so it does not extend the sharing to a native caller. Pluto callers get sharing across nested calls statically. Documented in the spec; a generic pointer entry that resolves unknown sharing at run time, beside the private variants, is recorded as outstanding in the effects plan.
• Templates that previously read output names use locals or single expressions. The Rebuild rewrite in this PR changes [26] to [37] and [2] to [6]. Live sharing also changes mem_alias_refine from Sibling: hello! to Sibling: static!.
• Preserve existing LLVM loop metadata when adding unroll hints (separate commit). It was required while the selector signatures changed the optimized Fib loop's shape; with the original prototypes restored it is a robustness fix and stays.

The memory model, README, ABI specifications, IR plan, and effects plan describe the final rule. The effects plan distinguishes the implemented %n input restriction from pending write-effect modeling.

Verification

• Race-enabled lexer, parser, compiler, and root tests pass; go vet ./... passes.
• Full suite: 76 passed, 0 failed; all 75 runtime leak checks report zero leaks.
• Existing fixtures cover both Fold orders, ownership, nested sharing, conditional writes, array resets, and caller-side staging. The only additional behavior pair from review is sequential versus simultaneous swap.
• IR tests cover the array-copy regressions, the alias variant reading its output's storage, an unaliased call using the public specialization, and a variant skipping an incompatible output; metadata tests cover preservation, explicit policies, and idempotence.
• Benchmarks against master (bench repo fib, fib_tail, harmonic; median of 10 with 5 warm-ups, native CPU, output parity checked): fib 0.97x, fib_tail 1.01x, harmonic 1.01x. With the earlier run-time selectors fib_tail was 1.10x slower (stable across three re-runs); restoring the plain prototype through compile-time variants recovered it.