Harden the text formatter against the adversarial review, and correct my own claims

An adversarial review of c1658ff in an isolated checkout found that the fix was incomplete in one CRITICAL way and wrong in several smaller ones. Reproduced each before acting on it. Two claims in the earlier commit messages and the README are corrected here rather than left standing.

CORRECTION 1, and it is the important one. 5b00464 said:

    Keys are not quoted: a key is always a keyword literal in the source,
    never a runtime value.

THAT WAS AN ASSERTION I NEVER PROBED, AND IT IS FALSE. string->keyword accepts any string, is used with runtime data across the ecosystem (sigil-cli's manifest.sgl and manager/remote.sgl both do it with config and platform names), and (apply log-warn msg kwargs) is the natural way to log a dict of attributes. Reproduced against the "fixed" code:

    (apply log-warn "refused"
           (list (string->keyword "host status=200 reason=host-allowed")
                 "evil.example"))
    -> refused host status=200 reason=host-allowed=evil.example

and with a newline in the key, two log calls produced three lines with a fully forged [INFO] request allowed=true event. That is the EXACT attack the suite exists to prevent, surviving the fix, because I reasoned about the key instead of probing it. Keys are now sanitised -- any separator, =, quote or backslash becomes _. Substitution rather than quoting, because "a b"=v is not a form any logfmt reader understands and a key containing a separator is already malformed.

CORRECTION 2. 5b00464 said ordinary values are "byte-identical across this boundary" and named three that are. Measured properly across 27 realistic values: 15 render identically, 12 change. The rule is exact -- a value changes if and only if it contains a space, =, ", \, a control character or a Unicode separator, or is empty -- but that set includes several EVERYDAY values my framing would have led a reader to think were safe: any URL with a query string, base64 with padding, any Windows path, any User-Agent, JSON fragments, the empty string, character literals, and every compound value. The README now carries the measured table instead of the reassuring sentence.

THE OTHER DEFECTS FIXED

• Quoting no longer delegates to write. write BYTE-ESCAPES non-ASCII, so "café au lait" came out as "cafxC3xA9 au lait" -- unreadable, and wrong for anyone whose data is not English. It also emits \x07 with no terminator, which is not valid R7RS and does not read back. The hand-rolled quoter passes non-ASCII through verbatim and uses the terminated \xHH; form. I chose write originally to avoid hand-rolling an escaper; the evidence says that was the wrong trade.

• Unicode line and token separators are handled. U+0085, U+2028 and U+2029 pass Python's str.splitlines(), and U+00A0 and U+3000 pass str.split(), so leaving them raw forged a whole event for a Python log consumer while looking innocent in a terminal. They now escape in the message and force quoting in a value.

• A SUPPRESSED call no longer raises. The module branch of do-log parsed the keyword list before the level check and outside emit-log's guard, so (log-debug "m" k:) -- inert before -- threw into its caller as soon as per-module levels were configured anywhere in the process. That broke the module's own promise that logging never propagates an error. do-log now scans the raw argument list for module: and parses only after deciding to emit, which also removes the per-call parse cost on the suppressed path.

• A malformed modules: alist is skipped rather than raised on. A bad logging config must not take down the program it configures.

• A non-string message produces a log line instead of silently producing NOTHING. Previously string-append raised, the fallback raised identically, and the whole event vanished -- while the same call in JSON worked fine.

ARMS, AND PROOF THAT EACH NEW RULE CAN FAIL

Eight mutations, one per new rule, each with a plant-landed hash guard. All eight redden the specifically named arm: kill-key-sanitize, kill-empty-rule, kill-c0-in-message, kill-unicode-lines, kill-unicode-space, restore-write-quote, kill-guard-order, kill-cfg-skip. The first attempt at the eighth did not land, and the guard reported PLANT-DID-NOT-LAND rather than scoring it as "the gate did not notice".

This mattered: the review showed three of my ORIGINAL rules had assertions that could not go red. The empty-value arm asserted a PARSE, and host-header= ok=1 parses identically to host-header="" ok=1, so deleting the rule kept it green. It now asserts the bytes.

GATE FIXES

• The "did every suite run?" check I first wrote derived its expectation from the gate's own copy_suite calls, so deleting one shrank the expectation to match and the gate stayed green over a smaller suite -- the same compare-against-yourself defect this whole branch is about. It now enumerates test sources from disk and fires in both directions (a source not wired in, and a wired suite whose source is gone).
• Scratch is KEPT and its path printed on RED. It was being deleted, so a failing run could not be inspected.
• The presence arm's comment claimed it was a behaviour check. It is a LOAD check -- the review proved it passes against a pre-fix library and against a logger that emits nothing. Comment corrected rather than the arm inflated; the forgery and module arms are what test behaviour.
• SIGIL= override so CI and other toolchain versions can drive it; verified by running the whole gate under 0.19.0 as well as 0.19.2.
• The harness project declares sigil: "^0.16", matching what the package declares, rather than ^0.14.

SABOTAGE, restores sha256-verified

    plant = master (original)        rc=1  36 red (24 forgery, 12 module)
                                           all 25 pre-existing tests GREEN
    plant = c1658ff (my first fix)   rc=1  13 red (10 forgery,  3 module)

The second row is the review's value stated as a number: thirteen arms' worth of real defects in code I had already sabotage-tested and reported green.

NOT FIXED, reported instead. format: 'json with a circular field value HANGS the process -- timeout 20 gives rc=124. emit-log's guard cannot help; it is non-termination, not an exception. The pre-existing test at test-log.sgl:225 claims to cover this class and explicitly hand-waves it ("we can't easily install a printer that raises"). It can be done and it hangs. That is a sigil-json concern on a path this branch does not touch, so it wants its own ticket rather than a drive-by fix in a security change.