bundling: fs/process stdlib + post-link callback + Apple .app in sx

Campaign Weeks 3-6 of /Users/agra/.claude/plans/lets-plan-to-move-splendid-pumpkin.md
land in one push: the bundling pipeline that used to live in
src/target.zig (createBundle, embedFramework, extractEntitlements,
buildInfoPlist, codesign) now lives in
library/modules/platform/bundle.sx and runs in the IR interpreter
after target.link() returns.

New language-side surface:
- library/modules/fs.sx — POSIX libc bindings (open/read/write/close,
  mkdir/unlink/rmdir, chmod, rename, access, basename/dirname). Variadic
  open() lowers to C's varargs via the new args: ..T form. Direct libc
  calls bypass *File method dispatch so they work from the post-link
  IR interpreter.
- library/modules/process.sx — popen-based run(cmd) returning
  ProcessResult{ exit_code, stdout }, plus env() and find_executable().
- library/modules/std.sx — xml_escape(s) and variadic path_join(parts).
- library/modules/compiler.sx — BuildOptions grows
  set_post_link_callback / set_post_link_module / binary_path
  accessors; bundle_path/bundle_id/codesign_identity/provisioning_profile
  setters + accessors; per-target predicates is_macos/is_ios/
  is_ios_device/is_ios_simulator + target_triple; framework_count /
  framework_at(i) / framework_path_count / framework_path_at(i);
  add_asset_dir(src, dest) + asset_dir_count / src_at / dest_at.

Compiler-side wiring:
- src/ir/compiler_hooks.zig — BuildConfig now carries post_link_callback_fn,
  post_link_module, binary_path, bundle_*, target_triple,
  target_frameworks, target_framework_paths, asset_dirs. Hook registry
  exposes every accessor; getters return "" / 0 for unset fields so
  bundle.sx can treat absent values uniformly.
- src/ir/host_ffi.zig (new) — dlsym(RTLD_DEFAULT) + arity-switched cdecl
  trampolines so #foreign("c") declarations resolve through the host
  libc during #run / post-link interpretation.
- src/ir/interp.zig — callForeign dispatch; build_config pointer
  injection so accessor hooks see live state during re-entry.
- src/core.zig — keeps the IR module alive past generateCode; exposes
  invokeByName / invokeByFuncId so main.zig can re-enter the
  interpreter after linking.
- src/main.zig — wires bundle/codesign/provisioning CLI flags +
  target_triple + framework lists into BuildConfig; invokes the
  post-link callback (by FuncId or by <module>.bundle_main lookup) once
  target.link() returns. When --bundle is set but no callback is
  registered, auto-falls-back to post_link_module = "platform.bundle"
  so the legacy --bundle CLI keeps working for any program that imports
  modules/platform/bundle.sx.

Apple .app bundler (library/modules/platform/bundle.sx):
- Single bundle_main entry covers macOS, iOS simulator, iOS device.
  Per-target Info.plist switch keys off is_ios()/is_ios_simulator() —
  iOS emits UIDeviceFamily / LSRequiresIPhoneOS /
  UIApplicationSceneManifest / DTPlatformName (iPhoneOS or
  iPhoneSimulator); macOS emits the minimal CFBundle* set.
- iOS-only steps:
  - Provisioning embed: fs.read_file + fs.write_file to
    <bundle>/embedded.mobileprovision.
  - Framework embed: recursive cp -R per -F search path into
    <bundle>/Frameworks/<Name>.framework/ (until fs.sx grows list_dir).
  - Entitlements extraction: four process.run calls (security cms -D,
    plutil -extract Entitlements xml1, plutil -extract
    ApplicationIdentifierPrefix.0, plutil -replace application-identifier)
    resolving the wildcard <TEAM>.* -> <TEAM>.<bundle_id>.
  - Real codesign with --entitlements when present.
- Asset dirs (add_asset_dir): recursive cp -R src/. into <bundle>/dest/.
  Missing src is treated as "nothing to do" so projects can register
  add_asset_dir("assets", "assets") unconditionally.

Parser:
- parseStmt() now accepts #import \"path\"; and #framework \"Name\"; as
  statement-position tokens. Needed for top-level
  inline if OS == .android { #import \"modules/platform/android.sx\"; }
  blocks (issue-0042 flatten pass surfaces them); chess's
  inline-if-with-#import was rejected at parse time before this fix.

Removals from src/target.zig:
- createBundle, embedFramework, extractEntitlements, buildInfoPlist,
  codesign (~210 lines). main.zig no longer calls createBundle after
  link(); the sx callback is the single entry point.

Tests / regression markers (all run under sx run host JIT):
- examples/115-post-link-callback.sx — callback registration round-trip.
- examples/116-fs-roundtrip.sx — fs.write_file -> fs.read_file -> exists.
- examples/117-process-roundtrip.sx — process.run + env + find_executable.
- examples/118-macos-bundle.sx — macOS .app via bundle_main callback.
- examples/119-interp-cast-ptr-cmp.sx — cast(T) val under interpreter.
- examples/120-interp-variadic-any.sx — variadic ..Any indexing in IR
  interpreter.
- examples/121-ios-sim-bundle.sx — iOS-sim cross-compile + .app with
  iOS-shaped Info.plist (added to tests/cross_compile.sh as the
  ios-sim tuple).
- examples/122-ios-device-bundle.sx — iOS device cross-compile +
  full codesign pipeline (provisioning embed + entitlements
  extraction + --entitlements codesign). Manually verified end-to-end:
  installed via xcrun devicectl device install app + launched
  successfully on iPhone 17 Pro.
- examples/123-inline-if-import-in-body.sx — locks in the parser fix.

zig build && zig build test && bash tests/run_examples.sh => 141 passed,
0 failed; bash tests/cross_compile.sh => 7 passed, 0 failed.

src/core.zig

@@ -29,6 +29,10 @@ pub const Compilation = struct {
     import_graph: std.StringHashMap(std.StringHashMap(void)),
     sema_result: ?sema.SemaResult = null,
     ir_emitter: ?ir.LLVMEmitter = null,
+    /// Lowered IR module, kept alive past `generateCode` so post-link
+    /// callbacks can re-enter the interpreter to invoke sx functions
+    /// (e.g. `platform.bundle.bundle_main` after `target.link`).
+    ir_module: ?*ir.Module = null,
     /// C sources requested by the lowering pass (not in the user's AST).
     /// E.g. the JNI env TL runtime when `#jni_env` is used. Merged with
     /// AST sources in `collectCImportSources`.
@@ -55,6 +59,10 @@ pub const Compilation = struct {
 
     pub fn deinit(self: *Compilation) void {
         if (self.ir_emitter) |*e| e.deinit();
+        if (self.ir_module) |m| {
+            m.deinit();
+            self.allocator.destroy(m);
+        }
         self.diagnostics.deinit();
     }
 
@@ -124,12 +132,43 @@ pub const Compilation = struct {
         ir_mod_ptr.* = try self.lowerToIR();
         var emitter = ir.LLVMEmitter.init(self.allocator, ir_mod_ptr, "sx_module", self.target_config);
         emitter.emit();
-        // IR module is no longer needed after LLVM IR has been generated
-        ir_mod_ptr.deinit();
-        self.allocator.destroy(ir_mod_ptr);
+        // Keep the IR module alive past LLVM emission so post-link
+        // callbacks can re-enter the interpreter via `invokeByName`.
+        self.ir_module = ir_mod_ptr;
         self.ir_emitter = emitter;
     }
 
+    /// Re-enter the IR interpreter after `generateCode` (and after linking,
+    /// if applicable) to invoke a named sx function. Used for the post-link
+    /// bundling callback. Returns the function's return value, or null if the
+    /// name doesn't resolve to a function in the lowered module.
+    pub fn invokeByName(self: *Compilation, name: []const u8, args: []const ir.Value) !?ir.Value {
+        const mod = self.ir_module orelse return null;
+        var found_id: ?ir.FuncId = null;
+        for (mod.functions.items, 0..) |func, i| {
+            const fname = mod.types.getString(func.name);
+            if (std.mem.eql(u8, fname, name)) {
+                found_id = ir.FuncId.fromIndex(@intCast(i));
+                break;
+            }
+        }
+        const fid = found_id orelse return null;
+        return try self.invokeByFuncId(fid, args);
+    }
+
+    /// Re-enter the IR interpreter and call a previously-resolved function
+    /// id. Companion to `invokeByName` — used when the FuncId was captured
+    /// at `#run` time (e.g. by `set_post_link_callback`) and we want to
+    /// invoke it later without name lookup.
+    pub fn invokeByFuncId(self: *Compilation, id: ir.FuncId, args: []const ir.Value) !ir.Value {
+        const mod = self.ir_module orelse return error.NoIRModule;
+        var interp = ir.Interpreter.init(mod, self.allocator);
+        defer interp.deinit();
+        if (self.ir_emitter) |*e| interp.build_config = &e.build_config;
+        ir.Interpreter.last_bail_op = null;
+        return try interp.call(id, args);
+    }
+
     /// Get link flags accumulated from #run build blocks.
     pub fn getBuildLinkFlags(self: *Compilation) []const []const u8 {
         if (self.ir_emitter) |*e| return e.build_config.link_flags.items;
@@ -154,6 +193,20 @@ pub const Compilation = struct {
         return null;
     }
 
+    /// Get the post-link callback function id (set via
+    /// `BuildOptions.set_post_link_callback(fn)`), if any.
+    pub fn getPostLinkCallback(self: *Compilation) ?ir.FuncId {
+        if (self.ir_emitter) |*e| return e.build_config.post_link_callback_fn;
+        return null;
+    }
+
+    /// Get the post-link module name (set via
+    /// `BuildOptions.set_post_link_module("name")`), if any.
+    pub fn getPostLinkModule(self: *Compilation) ?[]const u8 {
+        if (self.ir_emitter) |*e| return e.build_config.post_link_module;
+        return null;
+    }
+
     /// Collect C import source info — both from user-written `#import c { ... }`
     /// blocks in the AST AND from lowering-time auto-injections (currently:
     /// the JNI env TL runtime when `#jni_env` / `#jni_call`-with-omitted-env