…e cases

Three currently-red tests documenting real defects found auditing the
placeholder gate and the build-free coverage compare:

- A candidate that binds the same positional index to two different types
  (%1$@ %1$d) is accepted: signature() collapses it last-wins, and this PR's
  implied_positional widened the reach to bare-specifier sources (%d), which
  regressed from reject to accept.
- Dynamic field width/precision (%*d, %.*f) consume an extra int vararg the
  signature never counts, so %d and %*d reduce to the same signature.
- coverage_gap conflates keys that differ only in argument type (%d days vs
  %@ days), masking a genuinely dropped key behind a same-prose sibling.

…ting type

signature() stored positional specifiers in a Hash keyed by index with plain
assignment, so a second reference to the same index (`%1$@` then `%1$d`)
silently overwrote the first, collapsing an object/int conflict to one token.
A candidate that references argument 1 as both an object and an int passes an
int to a `%@` conversion at runtime — a wrong-vararg read. This PR's
implied_positional widened the reach: a bare-specifier source like `%d` now
normalizes to {1 => int} and matched the collapsed candidate, regressing that
case from reject to accept.

Record a conflicting reuse as a distinct token so it can never equal a
well-formed source's single type, while still allowing a consistent reuse
(`%1$d … %1$d`, which legally reads one argument twice).

A `*` in a specifier's field width or precision (`%*d`, `%.*f`) consumes its
own int argument before the value, so `%d` and `%*d` are not interchangeable.
The FORMAT_SPECIFIER regex matched the `*` but signature() emitted no token
for it, so the two reduced to the same signature and a translation could add
or drop a dynamic-width/precision argument undetected — reading one vararg
past what the call site supplies. Emit an int argument for each `*`, in
appearance order before the value.

canonical() replaced every format specifier with one sentinel regardless of
type, so keys differing only in argument type (`%d days` vs `%@ days`)
collapsed to the same coverage cell — a genuinely-dropped key was masked by a
same-prose sibling of a different type, defeating the same-basename overwrite
regression the coverage gate exists to catch. Strip only the positional index
(the sole difference between the genstrings source-form `%li` and the
xcstringstool-normalized `%1$li` for the same source literal), so `%li` and
`%1$li` still compare equal while `%d` and `%@` stay distinct.

… class

Danger's RuboCop pass flagged two offenses from the previous commits:

- Metrics/AbcSize: signature() exceeded the ABC limit once it gained the
  positional-conflict and dynamic-width handling. Extract record_specifier
  and add_positional so signature() is a thin loop again; behavior unchanged.
- Style/OneClassPerFile: the coverage_gap test added a second top-level class
  to catalog_helper_test.rb. Fold it into the file's single test class,
  renamed CatalogHelperTest since it now covers both reword detection and the
  coverage compare.