replace leading _ for private symbols with keyword hide

TODO.md

@@ -810,7 +810,7 @@
 
 33. explicit I/O provider (implemented)
   - `main` may take one canonical `@std/io Io`; parameterless entry points remain valid
-  - the compiler supplies a file-hidden macOS provider through an external no-argument C wrapper
+  - the compiler supplies a `hide system` macOS provider through an external no-argument C wrapper
   - readers and writers pair an explicit provider with `stdin`, `stdout`, or `stderr`
   - `read` and `write` validate provider counts; `write_all` handles partial writes and no progress
   - the system provider uses unbuffered libc `read`/`write`, retries interruption, and allocates nothing
@@ -819,8 +819,8 @@
   - bare qualified aliases use `Name :: alias package.Member` without adding a keyword
   - functions/type factories, named types, and globals transparently retain the target identity;
     mutable global aliases therefore share the original storage
-  - aliases resolve transitively at load time, consume their file-local import, preserve leading-
-    underscore visibility, and diagnose missing, hidden, unavailable, ambiguous, cyclic, or
+  - aliases resolve transitively at load time, consume their file-local import, preserve explicit
+    `hide` visibility, and diagnose missing, hidden, unavailable, ambiguous, cyclic, or
     conflicting targets
   - root `std` re-exports only `ArrayList(T)` for now; operations remain under `std/arraylist`
 
@@ -828,7 +828,24 @@
   - pointer sigils are highlighted as operators
   - type-factory calls in type positions and struct literals are highlighted as functions
 
-36. is it currently possible to access a subpackage from a parent package? if not, maybe it should be
+36. transitive package namespaces (spike completed; no language change)
+  - imports remain file-local implementation details, including explicitly named imports such as
+    `rl :: import "@vendor/raylib"`; naming an import only chooses its local qualifier
+  - packages expose declarations, not their imports, so imported namespaces never become public or
+    transitively reachable package members
+  - callers import each package they use directly; subdirectory layout does not create namespaces
+  - this keeps package lookup shallow and deterministic and avoids overloading import aliases with
+    declaration visibility
+
+36.5. explicit `hide` file-local declarations (implemented)
+  - `hide name ...` gives any named top-level function, global, native/C record, union, enum,
+    opaque/distinct type, or declaration/type alias the existing file-local semantics
+  - declarations remain public by default; a leading underscore is an ordinary identifier and `_`
+    remains the write-only sink
+  - hidden native and C declarations with the same name may coexist in separate files, while public
+    collisions are still diagnosed
+  - `hide` is reserved for named top-level declarations and is rejected on imports, locals,
+    parameters, fields, and anonymous declarations
 
 37. add a debug package in `std` that provides debugging utilities
   - add `debug.print` function making use of `std/io` to print values to the console