bundling: fs/process stdlib + post-link callback + Apple .app in sx

Campaign Weeks 3-6 of /Users/agra/.claude/plans/lets-plan-to-move-splendid-pumpkin.md
land in one push: the bundling pipeline that used to live in
src/target.zig (createBundle, embedFramework, extractEntitlements,
buildInfoPlist, codesign) now lives in
library/modules/platform/bundle.sx and runs in the IR interpreter
after target.link() returns.

New language-side surface:
- library/modules/fs.sx — POSIX libc bindings (open/read/write/close,
  mkdir/unlink/rmdir, chmod, rename, access, basename/dirname). Variadic
  open() lowers to C's varargs via the new args: ..T form. Direct libc
  calls bypass *File method dispatch so they work from the post-link
  IR interpreter.
- library/modules/process.sx — popen-based run(cmd) returning
  ProcessResult{ exit_code, stdout }, plus env() and find_executable().
- library/modules/std.sx — xml_escape(s) and variadic path_join(parts).
- library/modules/compiler.sx — BuildOptions grows
  set_post_link_callback / set_post_link_module / binary_path
  accessors; bundle_path/bundle_id/codesign_identity/provisioning_profile
  setters + accessors; per-target predicates is_macos/is_ios/
  is_ios_device/is_ios_simulator + target_triple; framework_count /
  framework_at(i) / framework_path_count / framework_path_at(i);
  add_asset_dir(src, dest) + asset_dir_count / src_at / dest_at.

Compiler-side wiring:
- src/ir/compiler_hooks.zig — BuildConfig now carries post_link_callback_fn,
  post_link_module, binary_path, bundle_*, target_triple,
  target_frameworks, target_framework_paths, asset_dirs. Hook registry
  exposes every accessor; getters return "" / 0 for unset fields so
  bundle.sx can treat absent values uniformly.
- src/ir/host_ffi.zig (new) — dlsym(RTLD_DEFAULT) + arity-switched cdecl
  trampolines so #foreign("c") declarations resolve through the host
  libc during #run / post-link interpretation.
- src/ir/interp.zig — callForeign dispatch; build_config pointer
  injection so accessor hooks see live state during re-entry.
- src/core.zig — keeps the IR module alive past generateCode; exposes
  invokeByName / invokeByFuncId so main.zig can re-enter the
  interpreter after linking.
- src/main.zig — wires bundle/codesign/provisioning CLI flags +
  target_triple + framework lists into BuildConfig; invokes the
  post-link callback (by FuncId or by <module>.bundle_main lookup) once
  target.link() returns. When --bundle is set but no callback is
  registered, auto-falls-back to post_link_module = "platform.bundle"
  so the legacy --bundle CLI keeps working for any program that imports
  modules/platform/bundle.sx.

Apple .app bundler (library/modules/platform/bundle.sx):
- Single bundle_main entry covers macOS, iOS simulator, iOS device.
  Per-target Info.plist switch keys off is_ios()/is_ios_simulator() —
  iOS emits UIDeviceFamily / LSRequiresIPhoneOS /
  UIApplicationSceneManifest / DTPlatformName (iPhoneOS or
  iPhoneSimulator); macOS emits the minimal CFBundle* set.
- iOS-only steps:
  - Provisioning embed: fs.read_file + fs.write_file to
    <bundle>/embedded.mobileprovision.
  - Framework embed: recursive cp -R per -F search path into
    <bundle>/Frameworks/<Name>.framework/ (until fs.sx grows list_dir).
  - Entitlements extraction: four process.run calls (security cms -D,
    plutil -extract Entitlements xml1, plutil -extract
    ApplicationIdentifierPrefix.0, plutil -replace application-identifier)
    resolving the wildcard <TEAM>.* -> <TEAM>.<bundle_id>.
  - Real codesign with --entitlements when present.
- Asset dirs (add_asset_dir): recursive cp -R src/. into <bundle>/dest/.
  Missing src is treated as "nothing to do" so projects can register
  add_asset_dir("assets", "assets") unconditionally.

Parser:
- parseStmt() now accepts #import \"path\"; and #framework \"Name\"; as
  statement-position tokens. Needed for top-level
  inline if OS == .android { #import \"modules/platform/android.sx\"; }
  blocks (issue-0042 flatten pass surfaces them); chess's
  inline-if-with-#import was rejected at parse time before this fix.

Removals from src/target.zig:
- createBundle, embedFramework, extractEntitlements, buildInfoPlist,
  codesign (~210 lines). main.zig no longer calls createBundle after
  link(); the sx callback is the single entry point.

Tests / regression markers (all run under sx run host JIT):
- examples/115-post-link-callback.sx — callback registration round-trip.
- examples/116-fs-roundtrip.sx — fs.write_file -> fs.read_file -> exists.
- examples/117-process-roundtrip.sx — process.run + env + find_executable.
- examples/118-macos-bundle.sx — macOS .app via bundle_main callback.
- examples/119-interp-cast-ptr-cmp.sx — cast(T) val under interpreter.
- examples/120-interp-variadic-any.sx — variadic ..Any indexing in IR
  interpreter.
- examples/121-ios-sim-bundle.sx — iOS-sim cross-compile + .app with
  iOS-shaped Info.plist (added to tests/cross_compile.sh as the
  ios-sim tuple).
- examples/122-ios-device-bundle.sx — iOS device cross-compile +
  full codesign pipeline (provisioning embed + entitlements
  extraction + --entitlements codesign). Manually verified end-to-end:
  installed via xcrun devicectl device install app + launched
  successfully on iPhone 17 Pro.
- examples/123-inline-if-import-in-body.sx — locks in the parser fix.

zig build && zig build test && bash tests/run_examples.sh => 141 passed,
0 failed; bash tests/cross_compile.sh => 7 passed, 0 failed.

src/main.zig

@@ -401,6 +401,25 @@ fn deriveOutputName(input_path: []const u8) []const u8 {
 }
 
 
+/// Format the "interpreter bailed during X" message, attaching the IR op
+/// and the source location (line:col) when the interpreter captured them.
+fn printInterpBailDiag(comp: *const sx.core.Compilation, label: []const u8, err: anyerror) void {
+    const op = sx.ir.Interpreter.last_bail_op orelse {
+        std.debug.print("error: {s} failed: {s}\n", .{ label, @errorName(err) });
+        return;
+    };
+    if (sx.ir.Interpreter.last_bail_file) |file| {
+        if (comp.import_sources.get(file)) |source| {
+            const loc = sx.errors.SourceLoc.compute(source, sx.ir.Interpreter.last_bail_offset);
+            std.debug.print("error: {s} failed: {s} (op={s}) at {s}:{d}:{d}\n", .{ label, @errorName(err), op, file, loc.line, loc.col });
+            return;
+        }
+        std.debug.print("error: {s} failed: {s} (op={s}) at {s}:+{d}\n", .{ label, @errorName(err), op, file, sx.ir.Interpreter.last_bail_offset });
+        return;
+    }
+    std.debug.print("error: {s} failed: {s} (op={s})\n", .{ label, @errorName(err), op });
+}
+
 fn readSource(allocator: std.mem.Allocator, io: std.Io, input_path: []const u8) ![:0]const u8 {
     const source_bytes = std.Io.Dir.readFileAlloc(.cwd(), io, input_path, allocator, .limited(10 * 1024 * 1024)) catch |err| {
         std.debug.print("error: cannot read '{s}': {}\n", .{ input_path, err });
@@ -601,14 +620,6 @@ fn compileWithTimer(allocator: std.mem.Allocator, io: std.Io, input_path: []cons
     };
     timer.record("link");
 
-    // Wrap into a .app bundle if requested (iOS/macOS).
-    if (merged_config.bundle_path) |bp| {
-        timer.mark();
-        sx.target.createBundle(allocator, io, final_output, merged_config, fws) catch std.process.exit(1);
-        timer.record("bundle");
-        std.debug.print("bundled: {s}\n", .{bp});
-    }
-
     // Wrap into an .apk if requested (Android).
     if (merged_config.apk_path) |ap| {
         timer.mark();
@@ -617,6 +628,77 @@ fn compileWithTimer(allocator: std.mem.Allocator, io: std.Io, input_path: []cons
         std.debug.print("apk: {s}\n", .{ap});
     }
 
+    // Make the linked binary's path + bundling config visible to the
+    // post-link callback via `BuildOptions.binary_path()`,
+    // `BuildOptions.bundle_path()`, etc. CLI flags
+    // (`--bundle Foo.app`, `--bundle-id`, ...) feed in here so the sx
+    // bundler doesn't need a separate code path.
+    if (comp.ir_emitter) |*e| {
+        e.build_config.binary_path = final_output;
+        if (e.build_config.bundle_path == null) e.build_config.bundle_path = merged_config.bundle_path;
+        if (e.build_config.bundle_id == null) e.build_config.bundle_id = merged_config.bundle_id;
+        if (e.build_config.codesign_identity == null) e.build_config.codesign_identity = merged_config.codesign_identity;
+        if (e.build_config.provisioning_profile == null) e.build_config.provisioning_profile = merged_config.provisioning_profile;
+        // Target triple + framework lists drive the sx bundler's per-platform
+        // branching (iOS device vs simulator vs macOS) and `Frameworks/`
+        // embedding. Slice fields point into the long-lived target_config /
+        // CLI argv buffers, which outlive the post-link callback.
+        if (merged_config.triple) |t| e.build_config.target_triple = std.mem.span(t);
+        e.build_config.target_frameworks = fws;
+        e.build_config.target_framework_paths = merged_config.framework_paths;
+    }
+
+    // CLI `--bundle <path>` migration shim. The legacy Zig bundler
+    // path (target.createBundle) has been retired; the equivalent
+    // logic now lives in `library/modules/platform/bundle.sx`. If the
+    // user passed `--bundle` on the command line but did NOT register
+    // a post-link callback themselves, point the resolver at
+    // `platform.bundle.bundle_main`. The lookup is best-effort: if the
+    // source doesn't `#import "modules/platform/bundle.sx"`,
+    // `invokeByName` returns null and the existing "not found" branch
+    // prints a clear migration message.
+    if (comp.ir_emitter) |*e| {
+        if (e.build_config.bundle_path != null and
+            e.build_config.post_link_callback_fn == null and
+            e.build_config.post_link_module == null)
+        {
+            e.build_config.post_link_module = "platform.bundle";
+        }
+    }
+
+    // Post-link callback: if the user registered one via
+    // `BuildOptions.set_post_link_callback(fn)` or
+    // `set_post_link_module("name")`, re-enter the IR interpreter and
+    // invoke that sx function now. A `false` return fails the build.
+    if (comp.getPostLinkCallback()) |fid| {
+        const ret = comp.invokeByFuncId(fid, &.{}) catch |err| {
+            printInterpBailDiag(&comp, "post-link callback", err);
+            return error.CompileError;
+        };
+        if (ret.asBool() == false) {
+            std.debug.print("error: post-link callback returned false\n", .{});
+            return error.CompileError;
+        }
+    } else if (comp.getPostLinkModule()) |mod_name| {
+        const qualified = try std.fmt.allocPrint(allocator, "{s}.bundle_main", .{mod_name});
+        defer allocator.free(qualified);
+        const ret_opt = comp.invokeByName(qualified, &.{}) catch |err| {
+            const label = try std.fmt.allocPrint(allocator, "post-link module '{s}.bundle_main'", .{mod_name});
+            defer allocator.free(label);
+            printInterpBailDiag(&comp, label, err);
+            return error.CompileError;
+        };
+        if (ret_opt) |ret| {
+            if (ret.asBool() == false) {
+                std.debug.print("error: post-link module '{s}.bundle_main' returned false\n", .{mod_name});
+                return error.CompileError;
+            }
+        } else {
+            std.debug.print("error: post-link module '{s}.bundle_main' not found\n", .{mod_name});
+            return error.CompileError;
+        }
+    }
+
     // Post-process wasm HTML: inject content hash for cache busting
     if (merged_config.isEmscripten() and std.mem.endsWith(u8, final_output, ".html")) {
         sx.target.postProcessWasmHtml(allocator, io, final_output);