wstring rides as UTF-16 code units, and the family's wire is one wire

Wire bytes move for astral text, stated first: a char above 0xFFFF now rides as its surrogate pair (two 32-bit groups), and the length field counts units — the old single code-point group, which the rest of the released family refuses, is gone from the write path and refused on read. BMP text is byte-identical to 2.0.0. This is the same intentional family break shipped in serialize v1.9.0, serialize.c v1.3.0 and serialize.cs v1.3.0; with this release all five implementations speak one wstring wire, and astral cross-language interop is certifiable at the family's interop pins.

• writer: char::encode_utf16 is the split (std's crystal, not hand arithmetic); measure agrees with write; infallible-writes shape (2.0.0) preserved.
• reader: refuses groups above 0xFFFF, interior NUL groups, unpaired and misordered surrogates, and a dangling high as the final group; well-formed pairs recombine into the char. Rust strings cannot hold unpaired surrogates, so refusal is the only conforming behavior.
• proofs: the family conformance pin ("a" + U+1F600, 8-unit buffer) byte-compared against serialize's pinned sequence; BMP golden unchanged; doctored refusal vectors proven both ways with accept-boundary neighbors; #![forbid(unsafe_code)] intact.

Not published to crates.io — the standing gate is unchanged.