fibers B1.2: Io capability + context.io + blocking impl + Future/async/await/cancel

Threads an `Io` capability onto `Context` exactly like `Allocator`: a
`protocol #inline` whose process-wide default is a stateless `CBlockingIo`
(the mirror of `CAllocator`), installed in `__sx_default_context`.

Library (library/modules/std):
- core.sx: `Io` protocol (spawn_raw / suspend_raw / ready / poll / now_ms /
  arm_timer) + `SpawnOpts` / `PinTarget` / `ParkToken`; `Context` gains an
  `io: Io` field LAST (allocator stays index 0, data stays index 1).
- io.sx (new): `CBlockingIo` + `impl Io` (blocking M:1 semantics — now_ms is
  a real monotonic clock, the rest are no-ops/0; suspend never called);
  `Future($R)` { value; state: FutureState; err: IoErr; park; task; canceled:
  Atomic(bool) } with `Value :: R`; the async ergonomic layer
  `async` / `async_void` / `await` (value-carrying `(R, !IoErr)`) / `cancel`.
  Built with the verified `= ---` + field-assign + `Closure(..$args) -> $R` +
  `..$args` idiom (NON-void $R only — Future(void) is deferred per issue 0150).
- std.sx: re-export the Io surface + the io.sx tail.

Compiler (src/ir):
- protocol.zig `emitDefaultContextGlobal` + comptime_vm.zig
  `materializeDefaultContext`: both materializers of `__sx_default_context`
  now build the inline CBlockingIo->Io vtable (7 words) at the new field.
- stmt.zig `lowerPush`: `push Context.{...}` now INHERITS omitted fields from
  the ambient context (seed the slot from current_ctx_ref, overwrite only the
  literal's named fields) — correct capability-bag semantics, so the partial
  `push Context.{ allocator = X }` sites don't zero a null `io` vtable.
- protocols.zig + lower.zig + error_analysis.zig: record protocol-impl method
  names so the "declared `!` but never errors" lint skips a conforming impl
  whose `!` is dictated by the protocol contract (e.g. Io.suspend_raw).

37 `.ir` snapshots regenerated: layout-only (the Context type now carries the
Io field, shifting type-table numbering); no stdout/stderr/exit changes.

The blocking Io + now_ms + Future/async work when `async` is called with the
receiver passed explicitly; the user-facing UFCS form `context.io.async(...)`
is blocked on a separate UFCS generic-inference bug (filed next).

Suite: 726 ran, 0 failed.

library/modules/std/core.sx

@@ -64,11 +64,61 @@ Allocator :: protocol #inline {
     dealloc_bytes :: (ptr: *void);
 }
 
+// --- Io capability protocol (impls live in std/io.sx) ---
+//
+// `Io` is threaded on `Context` exactly like `Allocator`: a `#inline`
+// protocol whose default impl (the stateless `CBlockingIo` in std/io.sx)
+// is installed in the process-wide `__sx_default_context`. Async runtime
+// is sx LIBRARY code — the compiler provides only the primitives (inline
+// asm, `abi(.naked)`, atomics) + fiber-safe codegen. The protocol is the
+// minimum the fiber scheduler [B1.3+] needs; everything ergonomic
+// (`async` / `await` / `cancel` / `timeout`) is a generic free-fn on top
+// (std/io.sx), the same way `alloc(T,n)` sits over `alloc_bytes`.
+//
+//   spawn_raw  — submit a task; opaque handle (B1.3 fiber bootstrap).
+//   suspend_raw— suspend current fiber; `!` so cancel can raise out.
+//   ready      — wake a parked fiber (B1.4/B1.5).
+//   poll       — drive one step; blocking impl returns 0.
+//   now_ms     — clock hook (a PROTOCOL method so the deterministic-sim
+//                Io [B1.4] can return a fake clock — the B1.4 keystone).
+//   arm_timer  — register a timer; backs `timeout` (B1.4).
+//
+// `ParkToken` is an opaque per-suspension token (unused by the blocking
+// impl). `SpawnOpts.pin` is inert in the M:1 model. (`PinTarget.on` —
+// pin to a specific `Thread` — is deferred with the M:N model; the
+// `on_thread` variant is a placeholder until a `Thread` type exists.)
+PinTarget :: enum { any; main; on_thread; }
+
+SpawnOpts :: struct {
+    pin: PinTarget = .any;
+}
+
+ParkToken :: struct {
+    handle: *void = null;
+}
+
+Io :: protocol #inline {
+    spawn_raw :: (entry: *void, arg: *void, opts: SpawnOpts) -> *void;
+    suspend_raw :: (park: ParkToken) -> !;
+    ready :: (park: ParkToken);
+    poll :: (deadline_ms: i64) -> i64;
+    now_ms :: () -> i64;
+    arm_timer :: (deadline_ms: i64, park: ParkToken) -> *void;
+}
+
 // --- Context ---
+//
+// `allocator` MUST stay at field index 0 (the heap-alloc lowering path
+// hardcodes it — src/ir/lower/call.zig). `io` is appended LAST so `data`
+// keeps its existing index 1 (minimizes the comptime-VM fallback churn).
+// Both Zig materializers of `__sx_default_context` (protocol.zig
+// `emitDefaultContextGlobal` + comptime_vm.zig `materializeDefaultContext`)
+// install the inline `CBlockingIo → Io` vtable at the new field.
 
 Context :: struct {
     allocator: Allocator;
     data: *void;
+    io: Io;
 }
 
 // User-space `xx` extension. `xx val : T` where the built-in conversion