fibers B1.2: Io capability + context.io + blocking impl + Future/async/await/cancel

Threads an `Io` capability onto `Context` exactly like `Allocator`: a
`protocol #inline` whose process-wide default is a stateless `CBlockingIo`
(the mirror of `CAllocator`), installed in `__sx_default_context`.

Library (library/modules/std):
- core.sx: `Io` protocol (spawn_raw / suspend_raw / ready / poll / now_ms /
  arm_timer) + `SpawnOpts` / `PinTarget` / `ParkToken`; `Context` gains an
  `io: Io` field LAST (allocator stays index 0, data stays index 1).
- io.sx (new): `CBlockingIo` + `impl Io` (blocking M:1 semantics — now_ms is
  a real monotonic clock, the rest are no-ops/0; suspend never called);
  `Future($R)` { value; state: FutureState; err: IoErr; park; task; canceled:
  Atomic(bool) } with `Value :: R`; the async ergonomic layer
  `async` / `async_void` / `await` (value-carrying `(R, !IoErr)`) / `cancel`.
  Built with the verified `= ---` + field-assign + `Closure(..$args) -> $R` +
  `..$args` idiom (NON-void $R only — Future(void) is deferred per issue 0150).
- std.sx: re-export the Io surface + the io.sx tail.

Compiler (src/ir):
- protocol.zig `emitDefaultContextGlobal` + comptime_vm.zig
  `materializeDefaultContext`: both materializers of `__sx_default_context`
  now build the inline CBlockingIo->Io vtable (7 words) at the new field.
- stmt.zig `lowerPush`: `push Context.{...}` now INHERITS omitted fields from
  the ambient context (seed the slot from current_ctx_ref, overwrite only the
  literal's named fields) — correct capability-bag semantics, so the partial
  `push Context.{ allocator = X }` sites don't zero a null `io` vtable.
- protocols.zig + lower.zig + error_analysis.zig: record protocol-impl method
  names so the "declared `!` but never errors" lint skips a conforming impl
  whose `!` is dictated by the protocol contract (e.g. Io.suspend_raw).

37 `.ir` snapshots regenerated: layout-only (the Context type now carries the
Io field, shifting type-table numbering); no stdout/stderr/exit changes.

The blocking Io + now_ms + Future/async work when `async` is called with the
receiver passed explicitly; the user-facing UFCS form `context.io.async(...)`
is blocked on a separate UFCS generic-inference bug (filed next).

Suite: 726 ran, 0 failed.

src/ir/lower/stmt.zig

@@ -1255,14 +1255,65 @@ pub fn lowerPush(self: *Lowering, ps: *const ast.PushStmt) void {
     const saved_ctx_ref = self.current_ctx_ref;
     defer self.current_ctx_ref = saved_ctx_ref;
 
-    const saved_target = self.target_type;
-    self.target_type = ctx_ty;
-    const ctx_val = self.lowerExpr(ps.context_expr);
-    self.target_type = saved_target;
-
     const slot = self.builder.alloca(ctx_ty);
-    self.builder.store(slot, ctx_val);
-    self.current_ctx_ref = slot;
+
+    // Inherit-omitted semantics: a `push Context.{ ... }` is a CAPABILITY
+    // bag — fields the literal does NOT name are inherited from the ambient
+    // context, not zero-inited. Zero-init would install a NULL `io`/
+    // `allocator` vtable (a latent crash if the field is later used inside
+    // the pushed scope). So seed the new slot from the ambient context,
+    // then overwrite only the fields the literal explicitly names.
+    //
+    // This applies only to a `Context.{...}` struct-literal context-expr;
+    // any other form (e.g. `push some_ctx_value`) keeps the whole-value
+    // store (no field-level merge to do).
+    const lit: ?*const ast.StructLiteral = switch (ps.context_expr.data) {
+        .struct_literal => |*sl| sl,
+        else => null,
+    };
+
+    if (lit != null and self.current_ctx_ref != Ref.none) {
+        // 1. Copy the ambient context into the fresh slot (load + store the
+        //    whole struct), so every omitted field carries its current value.
+        const ambient = self.builder.load(self.current_ctx_ref, ctx_ty);
+        self.builder.store(slot, ambient);
+
+        // 2. Overwrite only the named fields. `push Context.{...}` always
+        //    uses named field-inits (it is a Context literal); a positional
+        //    init has no field name to target, so it is rejected loudly
+        //    rather than silently writing the wrong field.
+        self.current_ctx_ref = slot; // body + field values see the new slot
+        for (lit.?.field_inits) |fi| {
+            const fname = fi.name orelse {
+                if (self.diagnostics) |d|
+                    d.addFmt(.err, ps.context_expr.span, "`push Context.{{...}}` requires named fields (positional init not supported)", .{});
+                continue;
+            };
+            const fl = self.fieldLvaluePtr(slot, ctx_ty, fname) orelse {
+                _ = self.emitFieldError(ctx_ty, fname, ps.context_expr.span);
+                continue;
+            };
+            const saved_target_f = self.target_type;
+            self.target_type = fl.ty;
+            const fval = self.lowerExpr(fi.value);
+            self.target_type = saved_target_f;
+            const fval_ty = self.builder.getRefType(fval);
+            const store_val = if (fval_ty != fl.ty and fval_ty != .void and fl.ty != .void)
+                self.coerceToType(fval, fval_ty, fl.ty)
+            else
+                fval;
+            self.builder.store(fl.ptr, store_val);
+        }
+    } else {
+        // Non-literal context-expr, or no ambient context to inherit from:
+        // lower the whole value and store it (the original behaviour).
+        const saved_target = self.target_type;
+        self.target_type = ctx_ty;
+        const ctx_val = self.lowerExpr(ps.context_expr);
+        self.target_type = saved_target;
+        self.builder.store(slot, ctx_val);
+        self.current_ctx_ref = slot;
+    }
 
     self.lowerBlock(ps.body);
 }