feat(format): expand the runtime safety gate

Replace the bare SemanticallyEqual call in every frontend (CLI fmt, LSP
formatting + rangeFormatting) with format.VerifySafe, which runs four
checks before any formatted output is emitted:

  - semantic equivalence  - the code token stream is unchanged
  - comment preservation  - no -- or /* */ comment is dropped, merged,
    split, reordered, or reworded (line endings / indentation normalised
    away; recurses into dollar-quoted bodies)
  - structural balance    - the () [] and BEGIN/CASE/IF/LOOP...END nesting
    profile matches, ignoring anything inside a comment or a string
  - idempotence           - a second format pass would not change it

On failure the CLI now prints the specific reason and keeps the original.

The comment check surfaced two real formatter bugs, both fixed in
formatBodyStatements:

  - multi-line /* */ comments inside a PL/pgSQL body had their interior
    lines re-split and reindented as if they were statements; they are
    now tracked and carried verbatim with the opening line
  - a column-0 -- line was glued onto the preceding line by the
    split-line-join, which merged consecutive comment lines into one

Regenerate testdata/corpus/test_mm_proc.pgsql (was carrying the mangled
output). TestCorpusIdempotentAndSafe now runs the full VerifySafe bundle;
add safety_test.go with targeted cases.

testdata/corpus/test_mm_proc.pgsql

@@ -138,7 +138,9 @@ BEGIN
 
     select ctl.rid_parent  as rid_parent
      , ctl.tableprefix as parent_prefix
-    from tasklist ctl --inner join t_adproclient cli on cli.rid_adproclient = ctl.rid_parent --  and ctl.tableprefix = 'tcli'
+    from tasklist ctl
+--inner join t_adproclient cli on cli.rid_adproclient = ctl.rid_parent
+--  and ctl.tableprefix = 'tcli'
     where ctl.rid_tasklist = p_data_rid into m_data_rid, m_data_prefix;
 
   elsif p_data_prefix::citext = 'ehr'
@@ -545,13 +547,14 @@ BEGIN
 
   /*
   ---Use this code to test
-  select pl_writefile('/mnt/t/temp/t.docx',r.p_doc) ,r.*
-  from mm_proc('docx','allfieldvalues', (
+select pl_writefile('/mnt/t/temp/t.docx',r.p_doc)
+,r.*
+from mm_proc('docx','allfieldvalues', (
   select tat.maindoc
   from templateattachment tat
   --cross join view_blob(tat.rid_templateattachment,'templateattachment','maindoc','rid_templateattachment','utf8') v
   where tat.description ilike 'Form 16 (%'
-  ), 'TCLI',1000016) r
+), 'TCLI',1000016) r
   */
 /*
 
@@ -1163,7 +1166,7 @@ BEGIN
       m_exec_orderstr = r_lp_t.parent_order_string;
       --raise notice 'Applying order % by for % %.', r_lp_t.parent_order_string, r_lp_t.parent_table_name,r_lp_t.field_name;
         /*
-      select s.parent_order_string
+        select s.parent_order_string
         from tmp_merge_init_fields f
           inner join tmp_merge_init_src s on s.parent_rid = r_lp_t.rid
             and s.merge_type = G_MTYPE_TBLROOT
@@ -1171,7 +1174,7 @@ BEGIN
         where f.source = r_lp_t.source
         limit 1
         into m_exec_orderstr;
-      */
+        */
 
     end if;
 
@@ -1330,7 +1333,9 @@ BEGIN
       inner
       join tmp_merge_init_fields d
       on d . mergetag = c . mergetag and d . tblparent = r_lp_t . tblid
-      where f . grand_rid = r_lp_t . parent_rid and f . merge_type = G_MTYPE_TBLROOT --and f.parent_rid = any(a_tblroot) --and d.table_level > 0
+      where f . grand_rid = r_lp_t . parent_rid and f . merge_type = G_MTYPE_TBLROOT
+--and f.parent_rid = any(a_tblroot)
+--and d.table_level > 0
 
       group by f . rid ) loop
         raise notice 'Inner Loop: %', r_lp_c . qry;