perf: rebuild sharing for multi-use foreign accessor reads (#248) - #255

Closes #248.

Problem

The linker annotated every foreign accessor @inline always, so each use site re-materialized a field read off the foreign table: Data_Show_foreign.showIntImpl(x). The default bought wrapper transparency, but stage 2 of #174 (PR #246) made the shared form strictly cheaper for multi-use names: an accessor kept as a binding is promoted to a chunk local, so every use is a register or upvalue access with zero table reads (the ADR 0001 microbenchmark puts the per-read win at 2.4x on PUC 5.1).

What changed

The linker now emits accessors carrying only their explicit pragma annotation (Note [Foreign bindings structure emitted by the Linker]), and a new final IR pass shareForeignAccessors (after the specialize fixpoint, before flattenDeepBinds) counts the accessor reads that survived optimization and re-binds every read occurring at two or more sites to its linker QName, rewriting the reads to references. The re-bound accessor is inserted right after its module's ForeignImport binding, so module-init order stays valid, and stage-2 promotion then turns it into a chunk local through the existing budget accounting.

Counting at the end of the pipeline catches duplication of any origin. The obvious alternative, keeping multi-use accessors at the withBinding decision, misses the copies minted later by call-site inlining (#180): a dictionary method resolved at several sites pastes one field read per site, and that is exactly how Data.Show.showIntImpl reaches its use sites. Measured after the last pass that can multiply reads, showIntImpl now lands as the shape the issue asks for:

local Data_Show_showIntImpl = Data_Show_foreign.showIntImpl

Constraints from the issue:

• Explicit pragmas keep their meaning in both directions: @inline <name> always opts a name out of the re-binding and keeps per-site field reads at any use count, while @inline <name> never keeps the accessor a shared binding from the start. Fork-side pragmas remain the escape hatch.
• ForeignLift-lifted bodies are now marked always by the lift itself. Without the annotation a multi-use lifted body (an abstraction, not a cheap projection) would stay a shared binding and its call sites would never beta-reduce.
• DCE is unaffected: the pass runs on the post-DCE module and only re-binds reads that are live by construction.
• Magic-do is unaffected: mid-pipeline shapes are identical to before, since accessors still dissolve like any cheap projection, and the sharing is rebuilt after magicDo has already consumed the Effect/ST chains. All Long* eval goldens are unchanged.
• [fork-ffi] prelude: flip @inline unit always to never — inlining unit duplicates the singleton allocation #176 becomes a special case: a multi-use unit accessor now shares one promoted local holding the singleton, with no per-name pragma needed.

Verification

• New golden Golden.ForeignAccessorDefault.Test (with eval oracle): a foreign used at two call sites materializes as a promoted local and both sites reference it; a foreign used once keeps the dissolved field read.
• Unit tests in Optimizer/Spec: a multi-use unannotated accessor is kept as a shared binding, a single-use one dissolves, an explicit always dissolves a multi-use accessor, and the existing never-veto test still passes.
• Golden churn: 40 golden.ir files (mostly Just Always turning into Nothing on dissolved reads) and 9 golden.lua files, all of them the shared form appearing (log, isNaN, unsafeCoerce, Ref.read, showIntImpl, ...). Every eval/golden.txt is byte-identical, so the semantic oracle never moved.
• cabal test all is green on the default seed plus seeds 7, 1337 and 424242 (the optimizer was touched); hlint is clean; fourmolu applied.