Graduated @inline directives: arity=N, accessor forms, and a directives file - #254

Closes #232.

What

The @inline pragma grammar grows from binary always/never to the full directive DSL from the issue:

@inline [export] name[.label|...label] (default | never | always | arity=N)   -- module header
Some.Module.name[.label|...label] (default | never | always | arity=N)        -- a --directives file line

arity=N inlines a binding only at call sites applying at least N arguments and pins it as a shared reference everywhere else, so a curried combinator specializes at saturated sites without losing its shared definition. The accessor forms attach a policy to one field of a dictionary record (.label) or to a field of the record a binding returns when applied (...label), instead of the whole record. default explicitly resets a target to the built-in heuristics, masking weaker sources. The new --directives <file> option supplies fully-qualified directives project-wide.

Sources layer by specificity, per target: a local module-header pragma beats the directives file, which beats @inline export pragmas shipped by the defining module, which beat the heuristics. Header pragmas stay strictly validated (a target matching nothing is still an error). Unmatched file entries are ignored so a shared file can cover optional dependencies, which is the property #242 needs.

How

• IR/Inliner.hs parses both sources into Pragma/Directives values and resolves precedence in one pure resolveModes; Annotation gains Arity Natural. Since export is itself a valid binding name, the parser backtracks: @inline export always names a binding called export.
• Translation (IR.hs) resolves the three sources per module and attaches winners to ann slots: whole-binding winners on the binding root, accessor winners on the object-literal field they select (validated against the binding's shape). The linear-resource leftover check now exempts file-origin targets. Directives on foreign names accept whole-binding always/never/default only.
• The optimizer generalizes the up-front never-set into an InlinePolicy (never / arity / field / applied-field, keyed by QName, collected once from the pristine uber-module). Arity names are vetoed for whole-binding inlining and for the uncurry split (which would rewrite their call sites to $w worker names the policy no longer matches), and pasted by inlineSaturatedCall exactly at qualifying sites, bypassing the size budget. Field policies gate resolveDictionaryProp (never vetoes, always bypasses the budget) and a new inlineAnnotatedProjection rule handles the arity-gated and applied-field forms.
• Two rules complete the cascade a directive-driven paste starts. sinkProjectionIntoLet moves a projection through the let residue beta reduction leaves behind. reduceKnownCtorRefRead, the through-a-reference companion of reduceKnownConstructor, folds constructor-eliminating reads through a saturated application of a reference to a top-level constructor binding, so (Op f).value0 resolves to f without pasting the constructor. The sink rule alone deepens the existing specialize pass: the LongReaderBind and LongWriterBind goldens shrink as Identity/WriterT dictionary towers now resolve fully, with byte-identical eval output.
• Plumbing: --directives in the CLI (parse errors fail the build with a proper Megaparsec report), threaded through compileModules; the golden harness picks up an optional committed directives.txt next to a golden module's files, so the file input is exercised end-to-end.

Also fixed along the way: an @inline annotation on a binding whose right-hand side is a bare application, variable reference, or record update was silently dropped during translation, so @inline foo never on a point-free definition had no effect.

Verification

Matches the issue's checklist. A combinator marked arity=2 inlines at a two-argument site and stays a reference at a one-argument site (plus at-least-N, budget-bypass, non-lambda paste, and no-uncurry-split unit tests). Precedence is covered at three levels: pure resolveModes tests, translation-level tests, and the Golden.DirectivesFile golden with a committed fixture where the file's always beats an exported never while a local never beats the file's always. The end-to-end Golden.DirectiveArity golden collapses runOp (Op f) x through beta and case-of-known-constructor to a folded constant, with an eval oracle. Golden.DirectiveAccessor covers both accessor forms, including an over-budget dictionary constructor that only the directive can resolve.

Beyond the suite (803 examples green), the flag was verified differentially on the real CLI: compiling the same entry with and without --directives flips exactly the directed binding, unmatched ghost entries are tolerated, and the emitted Lua runs with the expected output.

Notes

• spago run re-invokes the backend without build-phase flags, so --directives (like every build flag) applies to spago build output, not the --run re-link. Pre-existing gap, documented in the README.
• A field-level never is best-effort by design: a dictionary referenced exactly once is pasted whole by the use-once path and the projection folds without consulting policy, which is harmless since sharing is moot at a single use site. Documented on the rule.
• Unlocks Auto-infer transitive inline directives on synthetic specializations #241 (auto-inferred directives on synthetic specializations) and [fork-ffi] Ship a default @inline directive pack for the prelude/core forks #242 (a shipped default-directive pack).