test(io): converge Io.c mutation survivors to zero

Mutation-harden the Io.c formatting engine to a zero filtered-survivor
gate. A parallel triage classified the 229 survivors A/B/C; the killable
(A) ones get contract tests, the rest are accepted equivalents in the
ledger.

Kills (Tests/Std/Io.{Leak,Read,Write}.c): per-format-path write-side
scratch leak guards (large inputs force heap past the merge), quoted /
escaped read-budget frees, BitVec/Float overflow error-path frees, the
32-char spec rejection, the bare base-prefix rejection, and a
too-few-args BufReadFmt deadend.

Ledger (Conventions/mull-ignores.toml): ~220 verified equivalents --
dead inits, truthy-bool sentinels, unreachable boundaries, Validate*
removals, internal-DefaultAllocator / file-stream / syscall-path leaks
(non-observable without fault injection), and StrMergeL-released
redundant Deinits. Every entry carries a region-hash anchor; the gate
confirms 0 remaining, 0 stale, 0 bucket-A.

Full suite: 173/173.

Author: brightprogrammer