Add AVX2 escape kernels with runtime dispatch

[lpgauth]

Summary

• Add AVX2 (32-byte lane) variants of both string-escaping kernels in escape.rs: the escape-only path used for atom keys and the fused UTF-8-validate + escape path used for binary strings. They mirror the SSE2 structure exactly — classify control/"/\ bytes with a vector compare, bulk-store clean chunks, handle the first flagged byte via QUOTE_TAB, and fall into byte-by-byte validation on non-ASCII chunks.
• Dispatch selects AVX2 at runtime via is_x86_feature_detected!("avx2") (cached by std_detect after the first call), since precompiled binaries target baseline x86-64. SSE2 remains the fallback and also handles the sub-32-byte tail after the AVX2 main loop. The aarch64/NEON and scalar paths are untouched.
• Verified with a standalone harness that cross-checks every SIMD kernel against the scalar reference on 24,362 cases per arch: escapable bytes at every position around the 16/32/64-byte boundaries, multi-byte UTF-8 sequences sliding across lane boundaries, invalid-UTF-8 rejection, canary checks for writes past the reported length, and 20k fuzzed inputs. Runs: native aarch64 (NEON), x86_64 under Rosetta (SSE2 path), and x86_64 under QEMU -cpu max (AVX2 path actually executed) — all kernels agree with scalar everywhere.