render: emit lossless forms or error — never a document that re-parses differently

[chappihappymeal]

Closes #3.

Every case from the issue now either round-trips byte-for-byte or returns an error, on all three writer surfaces (emit_canonical, serde to_string, render / to_string_force_strings). The parser is untouched.

What changed

• Edge-whitespace / control-byte strings → verbatim block (§ 5.9.5(b), § 5.9.7). string_needs_multiline in render/helpers.rs routes them to the multi-line form on all surfaces. The check is Unicode-aware (char::is_whitespace), matching the parser's str::trim() — NBSP/NEL/U+3000 edges were the sneakiest variant of the bug.
• (-prefixed bodies → raw marker (§ 5.9.5(d)). The canonical writer had its own needs_raw_marker copy that missed the ( prefix and emitted unparseable documents; it now delegates to the shared helper.
• Marker-shaped bare items → raw marker. New item_needs_raw_marker covers the collisions a pair body doesn't have: leading ## (comment line), leading :: (the raw marker itself), sole ] / } (closers).
• Unrepresentable keys → error (CR precedent, § 5.9.7). push_escaped_key_segment now validates before writing: empty keys, edge whitespace (Unicode-aware, § 4), embedded line breaks, the bytes ( ) { } [ ] , (§ 3.7 defines no key escape for them on a pair line), and a leading ## produce a descriptive error naming the reason and the spec section. The serde path previously wrote map keys raw ({"a.b": 1} re-parsed as nesting); all its key sites now share this helper.
• One shared multi-line form chooser (§ 5.6.1). The stripped/verbatim selection had drifted across five copies; choose_multiline_form replaces them. Pretty renderers still prefer the indented stripped form when it is unconditionally safe and verbatim otherwise; the canonical writer still prefers verbatim. New: a lossless stripped fallback (an unindented line pins the parser's common-indent dedent to zero) rescues bodies with a )) line, and bodies no form can hold are an error everywhere — the canonical writer used to emit them broken, and its stripped emitter no longer trim_starts content lines.

Deliberate behaviour change

values_with_leading_trailing_whitespace_are_trimmed (from the 0.1.0 initial commit) asserted that serializing " padded " comes back as "padded" — "documented" trim behaviour. Spec 0.6 § 5.9.5(b) forbids the plain form for such bodies and § 5.9.7 mandates verbatim, so the test now asserts the round-trip. This is the only previously-passing expectation the PR flips.

Two smaller form changes for previously round-tripping values, both spec-mandated: strings with interior control bytes now emit as verbatim blocks (§ 5.9.7), and multi-line bodies containing both a sole-) and a sole-)) line now error on every surface instead of canonical emitting a broken document.

Verification

• tests/render_lossless.rs: 41 new tests, written red-first, covering every class on all three surfaces (round-trip asserts for representable values, error asserts for unrepresentable ones, guard tests for tricky-but-working keys and bodies).
• Full suite green (including the spec conformance fixtures and the existing exact-output ser/render tests); cargo clippy --all-targets -- -D warnings and cargo fmt --check clean.
• Differential check against v0.6.2: a corpus exercising scalars, nested compounds, dotted/escaped keys, both multi-line forms, :: literals and empty values renders byte-identically on old and new across all three surfaces — no output change for anything that already round-tripped.