I’ve been thinking about something similar to this Pure TH thing recently as well.
I was initially thinking about something similar, but now I think trying to rule out IO is the wrong way to go.
As you mention in your draft proposal, unsafePerformIO still exists. FFI is often another form of hidden IO, and is also very difficult to avoid.
A different form of impurity that isn’t mentioned is being able to access compiler internals by unsafeCoerce-ing into the typechecker monad, eg, Haskell dark arts, part I: importing hidden values.
I think a better approach might be to run TH using the external interpreter inside a container-like environment without networking and only the files it should be able to see. This would disallow access to typechecker internals, as we no longer run in the main process; would disallow most inappropriate uses of IO; and doesn’t require the addition of syntax, or a change to user code.