chore(deps): bump spx to 2.0.3

[Copilot]

This updates the builder workspace to SPX 2.0.3 so the GUI runtime version, downloaded web assets, and Go toolchain dependencies all resolve to the same release. The change keeps the repo’s SPX consumers aligned on a single upstream version.

• Version alignment

  • Update spx-gui/.env to VITE_SPX_VERSION="2.0.3"
  • Update spx-gui/install-spx.sh to download v2.0.3 assets

• Go module refresh

  • Bump github.com/goplus/spx/v2 to v2.0.3 in:
    • tools/ai
    • tools/spxls
    • tools/ispx
  • Refresh module sums after dependency resolution
  • Carry forward indirect dependency updates pulled in by the module refresh

• Generated/runtime artifacts

  • Regenerate the SPX GUI runtime assets against 2.0.3
  • Rebuild the Wasm outputs so packaged frontend artifacts match the upgraded SPX version

- VITE_SPX_VERSION="2.0.2"
+ VITE_SPX_VERSION="2.0.3"

- require github.com/goplus/spx/v2 v2.0.2
+ require github.com/goplus/spx/v2 v2.0.3

[fennoai]

Code Review — chore(deps): bump spx to 2.0.3

This is a clean, mechanical version-bump PR. All required locations are consistently updated and no stale 2.0.2 references remain.

Summary

Version consistency ✓ — All five update sites agree on 2.0.3:

• spx-gui/.env → VITE_SPX_VERSION
• spx-gui/install-spx.sh → SPX_VERSION
• tools/ai/go.mod, tools/ispx/go.mod, tools/spxls/go.mod

go.sum integrity ✓ — The h1: hash for github.com/goplus/spx/v2 v2.0.3 (Qb3n2/B04lsbOgLSZEXGYhOiPyGgWrRFhSU1+srSCdg=) is identical across every go.sum that references it, consistent with Go module proxy guarantees.

Security ✓ — No secrets or credentials in the diff. The install-spx.sh download URL uses HTTPS and the version string is a hard-coded literal (no injection vector).

One observation (non-blocking)

tools/ispx/go.mod picks up two additional bumps beyond the spx version itself:

• github.com/goplus/ixgo: v1.0.8 → v1.1.0 (direct dep)
• github.com/goplus/reflectx: v1.6.4 → v1.7.0 (indirect dep)

These are expected consequences of go mod tidy after the spx bump — both are goplus-ecosystem packages pulled forward to satisfy spx 2.0.3's minimum version requirements. The other two modules (tools/ai, tools/spxls) do not depend on them directly and are unaffected. No action needed, just noting the scope is slightly wider than the PR title implies.