feat(lang): attach ref-backed policy script as a reference input

[scarmuega]

Context

Today a policy in tx3 is effectively a named hash. You can declare a ref-backed policy:

policy Validator {
    hash: 0xABCDEF1234,
    ref: 0x…#0,
}

…and the ref is captured during lowering — but when Validator is used as the from of an input (spending a script-locked UTxO), the lowering threw the script source away and kept only the hash. As a result the policy's ref UTxO was never added to the transaction's reference_inputs, so the compiled Cardano tx had no way to find the script that must validate the spend.

This closes that gap for the flow:

1. define policy P { hash, ref }
2. use P as from in an input
3. expect P's ref UTxO to appear in the compiled tx's reference_inputs

In Cardano, including the ref UTxO (which carries the script) as a reference input is the complete and correct mechanism for a ref-backed policy — no witness-set script bytes are needed.

Changes

All in crates/tx3-lang/src/lowering.rs:

• Context gains a shared ref accumulator (Rc<RefCell<…>>) carried across every enter_* clone, with record_script_ref / drain_script_refs helpers. Dedups on insert.
• Symbol::PolicyDef lowering — when a policy is used in address context, capture policy.script.as_utxo_ref() into the accumulator before returning BuildScriptAddress(hash). Hash-only policies yield None (no-op).
• TxDef::into_lower restructured to seed the accumulator with explicit reference blocks first, lower the body (which records policy refs), then drain into Tx.references. Explicit refs keep their leading position; coincident refs dedup to one entry.

No backend change — compile_reference_inputs in tx3-cardano already maps Tx.references → Cardano reference_inputs.

Scope

Input from path for ref-backed policies. Out of scope (noted for follow-up): mint/burn under a ref-backed policy, and embedded-script (witness-set) attachment.

Verification

• New fixture examples/policy_reference_script.tx3 + generated .tir snapshot: ref UTxO appears in references, input resolves to BuildScriptAddress(hash).
• Unit tests: ref-backed policy → 1 reference input; same policy on two inputs → deduped to 1; hash-only policy → 0.
• cargo test -p tx3-lang: 170 passed, 0 failed — all pre-existing snapshots byte-identical (no regressions).

🤖 Generated with Claude Code