feat(format): expand the runtime safety gate

Replace the bare SemanticallyEqual call in every frontend (CLI fmt, LSP
formatting + rangeFormatting) with format.VerifySafe, which runs four
checks before any formatted output is emitted:

  - semantic equivalence  - the code token stream is unchanged
  - comment preservation  - no -- or /* */ comment is dropped, merged,
    split, reordered, or reworded (line endings / indentation normalised
    away; recurses into dollar-quoted bodies)
  - structural balance    - the () [] and BEGIN/CASE/IF/LOOP...END nesting
    profile matches, ignoring anything inside a comment or a string
  - idempotence           - a second format pass would not change it

On failure the CLI now prints the specific reason and keeps the original.

The comment check surfaced two real formatter bugs, both fixed in
formatBodyStatements:

  - multi-line /* */ comments inside a PL/pgSQL body had their interior
    lines re-split and reindented as if they were statements; they are
    now tracked and carried verbatim with the opening line
  - a column-0 -- line was glued onto the preceding line by the
    split-line-join, which merged consecutive comment lines into one

Regenerate testdata/corpus/test_mm_proc.pgsql (was carrying the mangled
output). TestCorpusIdempotentAndSafe now runs the full VerifySafe bundle;
add safety_test.go with targeted cases.

pkg/format/format_test.go

@@ -184,18 +184,16 @@ func TestCorpusIdempotentAndSafe(t *testing.T) {
 		}
 		src := string(data)
 		once := format(src)
-		twice := format(once)
-		if once != twice {
-			t.Errorf("%s: not idempotent", e.Name())
-		}
-		if !semanticallyEqual(src, once) {
-			t.Errorf("%s: formatting changed semantics", e.Name())
+		// VerifySafe bundles every runtime gate: semantic equivalence, comment
+		// preservation, structural balance, and idempotence.
+		if err := VerifySafe(src, once, config.Default()); err != nil {
+			t.Errorf("%s: %v", e.Name(), err)
 		}
 	}
 	if seen == 0 {
 		t.Skip("no corpus files")
 	}
-	t.Logf("formatted %d corpus files (idempotent + semantically equal)", seen)
+	t.Logf("verified %d corpus files (semantic + comments + structure + idempotence)", seen)
 }
 
 // semanticallyEqual is a test-local alias for the exported safety check.