fix(ir): keep a bare-Ref alias to an @inline always binding shared (#171) - #257

Closes #171.

Problem

Two individually sound inliner rules compose badly. The top-level inliner dissolves any bare-Ref binding into its use sites (a reference replacing a reference is free), and an @inline always binding pastes its body into every site that references it. Chain them and the alias multiplies the paste: Main.add = Ref Data.Semiring.intAdd used at two sites dissolves first, taking intAdd's reference count from one to two, and then Always fires at both. The result is two copies of the body where one shared alias binding was the better materialization point on both size and speed.

Since #248 the linker no longer auto-annotates plain foreign accessors, so the auto-always shape that triggers this today is a ForeignLift-lifted body: a lambda marked always by the lift so its call sites beta-reduce. An alias to such a binding used at several value positions (exports, record fields, arguments) gets the whole lambda duplicated per site, with no beta-reduction to pay for it.

What changed

withBinding now decides through topLevelInlinable, which diverges from the shared isInlinableExpr twice:

• The bare-Ref tier declines when the target name carries @inline always (policyAlways, a new InlinePolicy field). The alias survives, the target's body pastes into it once, and every alias site keeps referencing the single copy. Saturated call sites still reduce: the call-site inliner reads the alias's lambda RHS out of the inline environment as usual.
• The Always decision itself is keyed by name rather than by the RHS root annotation, for the reason every other directive already is: a rewrite can drop or transplant a live node's annotation, so the tree carries no reliable directive signal. Name-keying also closes the standing gap where a root annotation stripped by an earlier rewrite silently disabled an explicit always.

On top of that, annotations are now spent rather than left to drift. A whole-binding paste sheds the root annotation (mirroring the call-site paste in inlineSaturatedCall), so a binding that merely received an always-annotated body never turns unconditionally inlinable itself. That removes the last consumer that depended on an annotation surviving optimization: shareForeignAccessors used to test each read node's annotation to honor the per-site contract of an explicit always accessor pragma, and now reads the opt-out from the same name-keyed policy instead. The pragma's meaning no longer hangs on an annotation happening to survive every rewrite between the linker and the last pass.

The local rules (betaReduce, inlineLocalBinding) keep reading the root annotation directly: isInlinableExpr is unchanged there, with its structural tiers split out as isInlinableValue for the top-level predicate to reuse.

Explicit pragma contracts are preserved. A user's @inline always accessor still ends as a per-site field read even through an alias: the read pasted into the alias is a cheap projection, so the Deref tier dissolves the alias on the next round, and shareForeignAccessors skips the copies by name. That is the per-site contract #248 documented. The scope note in #171 confines the defect to the auto-annotation interaction, and that is what the fix targets.

Verification

• New unit test in Optimizer/Spec (red before the fix, green after): a bare-Ref alias to an always-annotated unary lambda, referenced by two exports, survives as the single binding, both exports keep referencing it, and the body materialized into the alias carries no annotation.
• Regression pins around the new surface: a use-once alias to an always binding still dissolves (the veto guards multi-use aliases only), a fold that drops the root annotation no longer disables an explicit always (the @inline never mirror from @inline never is silently ignored and does not prevent inlining #131), and shareForeignAccessors re-binds annotated reads of an undirected name while normalizing the inserted binding's annotation slot.
• The Revisit the foreign-accessor @inline always default: stage-2 promotion made the shared form free #248 suite pins the name-keyed opt-out: a twice-referenced accessor annotated @inline always still dissolves per site even though the pasted reads now carry no annotation.
• Golden corpus (after rebasing onto the Consume prelude v7.3.1: share the unit singleton (@inline unit never) #258 package-set repoint): 6 golden.ir files churn, every changed line a Just Always printing as Nothing on a pasted node. Every golden.lua and every eval oracle is byte-identical.
• cabal test all green on the default seed plus seeds 42, 1337 and 999999 (the optimizer was touched); hlint clean; fourmolu applied.