Closes #231.

What

Two small analysis lattices sharpen the shared inlining guard:

• Complexity = Trivial < Deref < KnownSize < NonTrivial (complexityOf, a bottom-up classifier next to expSize)
• Capture = CaptureNone < CaptureBranch < CaptureClosure (countFreeRefUsage, a per-site variant of countFreeRef reporting the strongest wrapper crossed between the root and each reference)

Two new tiers feed the guard shared by withBinding, betaReduce and inlineLocalBinding (Note [Complexity and Capture gate inlining]):

• Deref tier: an expression of complexity at most Deref and size under 16 pastes at any use count. Records and module tables are write-once, so re-reading a projection chain preserves semantics. Multi-use projection aliases dissolve.
• KnownSize tier (local sites only): a closed lambda under 16 nodes whose bound name is used only outside branches and closures substitutes at every site, so a locally bound combinator beta-reduces everywhere. The CaptureNone gate refuses to move a lambda literal into a branch or closure (the per-call closure-allocation pathology of LuaJIT blacklists loopified self-recursion while the loop body still allocates closures #204), so closedness and small size alone do not admit duplication.

A NonTrivial body is never duplicated. The @inline pragmas, the used-once path, the ForeignImport veto and the module-level count map are untouched; inlineSizeBudget = 64 stays the call-site ceiling.

Red → green

The spec commit lands first with a compile-ready skeleton (exact totals, CaptureNone context): 106 examples, 6 failures. Failing were the Deref tier, both KnownSize substitution paths and the three capture-context examples; the sharing pins and every pre-existing spec passed. The feat commit turns the six green without touching the pins.

One pre-existing fixture moved: the #131 leak-guard test used a projection-shaped field, which the Deref tier now inlines on its own merit regardless of annotation. The fixture is an annotated application now, so only a leaked Just Always can make the binding inlinable and the guard keeps its teeth.

Corpus

10 of 62 golden modules move, net -223 lines of generated Lua. All 31 eval oracles pass unchanged (they are never auto-accepted), luacheck passes, and the checked pipeline lints every pass boundary. A scan of the churn found no added line pattern whose occurrence count grew against the old goldens: nothing non-trivial got duplicated.

The Uncurry module shows the intended end shape: tiny uncurried workers like add$w = function(x, y) return x + y end disappear and their call sites fold to +. The collapse is a domino cascade rather than a direct admission: a new tier dissolves a cheap binding, the next binding becomes used-once for the existing rule, and the pass fixpoint rolls forward. A minimal probe confirms a twice-used worker still survives on its own, and the cascade surfaced a separate gap in the call-site inliner (n-ary heads), filed as a follow-up.

Left for follow-ups

Per-use-kind counters (call/access/case) and an admission for a projection used only in call position. #239 and #240 consume the Capture and exact-use groundwork this PR lays.