feat!: rebuild message output with safe auto formatting

[ss-o]

Summary

• make byte-preserving --auto=safe formatting the default for +zi-message
• add strict options, literal mode, semantic levels, configurable color policy, descriptor-safe output, and +zi-progress
• preserve explicit Zi markup while keeping unknown tags literal
• add focused behavior, state-isolation, terminal-capability, contract, and performance coverage
• register +zi-message and +zi-progress as monitored public contract surfaces with SHA-pinned wiki evidence

Closes #456.

Companion documentation: z-shell/wiki#897

Migration plan

The default auto mode changes from the legacy context-sensitive formatter to deterministic safe recognition. Callers that need exact unformatted bytes should use --literal, or combine --auto=off --color=never. Callers that intentionally relied on command, function, plugin-directory, or filesystem discovery should opt into --auto=contextual or configure zstyle ':zi:message' auto contextual.

+zi-message now terminates normal messages with LF unless -n is supplied. Progress updates that require carriage-return behavior should use +zi-progress. Option-like message text must follow --, and invalid options now fail with status 2 instead of passing through ambiguously.

The public-contract analyzer reports only informational definition and consumer-evidence additions, so no destructive contract-impact disposition marker is required.

Public contract impact

• adds monitored message-output and message-progress surfaces
• adds SHA-pinned evidence for the new message guide and the existing overview consumer
• preserves all previously monitored surfaces

Validation

• zsh -f -n zi.zsh lib/zsh/autoload.zsh tests/message-formatting.zsh
• zcompile -R for zi.zsh
• tests/message-formatting.zsh, including 27 behavior groups
• safe-auto benchmark: 819.5 microseconds per call, below the 1 millisecond guard
• real pseudo-terminal checks for automatic color and NO_COLOR
• exact Ubuntu 24.04 and Zsh 5.9 container reproduction
• archive extraction, completion refresh, parallel update, path resolution, Plugin Standard callbacks, public contract impact, self-update reload, directory mirror, and version reporting tests
• actionlint
• git diff --check

Documentation

The companion guide documents the rendering pipeline, safe and contextual auto modes, options, semantic levels, color policy, progress output, migration examples, and compatibility boundaries.