[ROADMAP] Restore full negative-space diagnostics, settings, TUI, and safe repair

[hyperpolymath]

Problem

The repository retained product documentation and configuration scaffolding after
most active source modules had become TODO-only AffineScript stubs. Its CI used
an inline find/grep approximation, suppressed errors, and reported readiness
without running Empty-linter. A minimum Bun audit gate is being restored
separately; this issue tracks the intended product beyond that minimum.

Originating acceptance fixture

Add an end-to-end fixture based on the incident that inspired Empty-linter: an
editor inserted a hidden formatting character into material being submitted to
the IETF Datatracker, which repeatedly rejected it without making the offending
location comprehensible.

The fixture must report:

• exact code point and UTF-8 bytes;
• file, line, Unicode-scalar column, and byte offset;
• visible escaped context and character/category description;
• whether removal is mechanically safe, semantic, or ambiguous;
• an inspectable patch or clean copy without unrelated changes;
• input/output hashes, provenance, and a successful rescan record.

Detector expansion

• Unsafe C0 controls and DEL (landed in the minimum gate)
• Unicode separators, bidi overrides/isolates, tags, variation selectors,
  object/interlinear markers, fillers, and other format controls
• Zalgo/suspicious combining-mark sequences without rejecting legitimate
  scripts or diacritics
• Hidden or zero-size text and suspicious font/style runs
• Office/OpenXML, Publisher, DOCX/PPTX/XML conversion artefacts
• PDF structure and conversion artefacts
• Spreadsheet formula cells whose displayed result is empty, with a clear
  distinction between formula, cached value, and rendered display
• Configurable visible-character rendering comparable to showing formatting
  marks in an editor

Product surface

• Load and validate settings; the existing Nickel file is currently data,
  not an active configuration path
• TUI for scanning, filtering, context inspection, profiles, and reviewed
  repair plans
• Stable machine-readable diagnostic, repair-plan, provenance, and rescan
  schemas
• Conservative autofix policy: semantic joiners/controls are never removed
  solely because they are invisible
• Explicit audit, propose, approve, apply-to-copy, verify, and refuse states
• UTF-8 byte offsets and Unicode-scalar columns; do not label UTF-16/string
  indices as Unicode columns

Optional suite composition

Keep Empty-linter independently useful. Define product-owned Groove capability
manifests; use Spline for typed exchange once Spline meets its promotion bar and
Cleave for authority/lifecycle boundaries once those postures are demonstrated.
Do not create a duplicate central integration engine.

Potential consumers/adapters include Formatrix Docs, Docmatrix, Blocky Writer,
Berrywiki, and ProgBlocks. ForthWall remains disconnected or proposal-only
until its separate proof and independent-verification gates are complete.

Non-negotiable truth conditions

• configured, wired, implemented, tested, proved, and deployed are
  separate statuses.
• A demo or TODO module must not be described as product capability.
• Scanner errors must fail distinctly from findings.
• A clean-result test is invalid until a planted unsafe input is detected.
• Audit mode never mutates input.