feat(format): add runtime semantic-equality safety gate

AGENTS.md

@@ -59,6 +59,14 @@ testdata/corpus/   — real-world .pgsql procedures used as the safety/idempoten
 3. **Idempotence**: `fmt(fmt(x)) == fmt(x)`.
 4. **Graceful degradation**: any span the parser cannot handle is passed through verbatim
    rather than corrupted.
+5. **Runtime safety gate**: every frontend (CLI `fmt`, LSP `textDocument/formatting` and
+   `rangeFormatting`) calls `format.SemanticallyEqual(src, out)` before writing or returning
+   formatted output. It re-lexes both sides and compares non-trivia token streams
+   (case-insensitive for identifiers/keywords, exact otherwise, recursing into dollar-quoted
+   bodies). If it ever returns false, the formatter has a bug — the caller must refuse to
+   write/emit the result and keep the original source, never guess or best-effort it. This is
+   not just a test assertion (`pkg/format/format_test.go`); it is enforced at runtime so a
+   formatter bug can never silently drop or alter code.
 
 ## Commands