fix: time, bounds, and the day that must stay dark

[vyncint]

Thirteen findings from a full read of 0.2.0, filed as #2–#14 and fixed here. The
thread through most of them is that "today" was ambient rather than an input,
which is why a test could rot, a report could call a dangerous day free, and
docs/ART.md could not reproduce its own example output.

The one that matters most

A day inside the text block that is not part of a letter has to stay empty,
and a contribution on it is the only loss nothing takes back. Those days were
dropped from the plan for having nothing to report (src/plan.rs, "a dark day
that is dark is not news"), so Plan::on answered None and every surface
described them as days outside the text:

  tomorrow    Thu Aug 20  ·  not part of the text — anything you commit today shows

2026-08-20 is inside VYNCINT's block, week 33 row 4. Committing on it punches a
permanent hole. It now reads:

  today       Wed Aug 19  ·  inside the letters and already lit (113) — a permanent hole
  tomorrow    Thu Aug 20  ·  inside the letters — keep it dark, or it becomes a permanent hole

  the next seven days
    Wed Aug 19   hole
    Thu Aug 20   keep dark
    Fri Aug 21   letter  110 to go

Standing::kind gains keep-dark, and hole now names damage rather than
position — a clean day inside the letters is keep-dark, and becomes a hole
once it is too bright. The Action gains today-kind and tomorrow-kind, so
do not commit tomorrow can arrive while it can still be acted on.

Two new flags

--today DATE makes the tracker's answer a fact about a date rather than
about when it ran. That is what defuses #3, what lets docs/ART.md keep its
"reproduce this exactly" promise, and what answers "what will 1 June owe?".

--backfill commits each day's shortfall instead of a flat count. A plain
--write puts the same number on every lit day including the ones already
bright, and adding to the busiest of those raises the year's peak — which raises
what every other letter day needs, so the bar moves as you walk towards it. A
shortfall provably cannot: the brightest shade is three quarters of the peak, so
topping a day up to need never exceeds the busiest day. One pass.
a_backfill_finishes_the_plan_without_moving_the_target adds the shortfalls to a
real year and checks the price did not move.

Bounds

--year was range-checked because a binary once "passed 999999 through to a
panic". Every other number took the unguarded path, and as is not a check:

before	now
--commits -1 → 4,294,967,295 commits	refused
--commits 0 → bright letters, no commits	refused
--top -1 → wrapped past the guard meant to catch it	refused
--start-week -1 → panic in NaiveDate + Days	refused
--start-week 100 → silently drew a plan of no days	refused, naming the last column that fits

One Args::number_in primitive, which year() now rides on so the two cannot
drift apart.

Everything else

• A saved plan's user is loaded and then discarded #6 a saved plan's user was read out of the file and then overwritten with
  the nothing a bare --track carries — so it tracked the wrong person rather
  than saying so.
• --merge with a calendar from another year silently reports an empty year #8 a --merge calendar from another year filtered down to nothing, and
  9,527 contributions read as an empty, trivially-reachable year.
• fail-on: behind fires for background days but reports a letter day #9 fail-on: behind tested today.short, which is also non-zero for a
  short background day — so with background set, ~290 days a year failed the
  job and blamed a letter day for it.
• Numeric flags accept negatives and zero: --start-week -1 panics, --commits -1 wraps to 4 billion #5/The back-dating command --track prints does not do what the report promises #7 the back-dating command --track printed did not do what the
  sentence above it promised: it ignored the saved plan, defaulted to 4 commits
  where the plan needed 110, and wrote to every lit day.
• Duplicated and missing rustdoc: probe reads twice, demo has the wrong summary #10 term::probe had doc comments on both sides of its #[cfg] and
  rendered them concatenated on docs.rs; calendar::demo's summary line belonged
  to Stats; the non-unix probe had none.
• CI: add a Windows check job — the cfg(not(unix)) path is never compiled #11 a Windows job — the cfg(not(unix)) path was compiled by no gate and
  had drifted in two ways -D warnings catches.
• y, Y, PageUp and PageDown change year but are documented nowhere #12 y/Y removed (undocumented, duplicated four other keys, and y
  means yank to the audience h j k l is for); PageUp/PageDown documented.
• Two small cleanups: demo re-implements art::level, sixel gives up a palette register #14 sixel bailed at a full palette rather than full-plus-one, one step
  before seen.len() as u8 would have wrapped to 0 and aliased a colour;
  restructured so no such index is constructed. calendar::demo no longer
  re-implements art::level.

Also, unasked but adjacent: a login resolved from a plan file is now stripped of
control characters where it is resolved rather than at each place that prints it,
which is the rule the calendar already followed.

Testing

• 115 tests, up from 96. New: the backfill fixed-point property, the retained
  keep-dark days, place's refusal (including usize::MAX), --today
  reproducibility, the flag bounds, the plan's user, the year-mismatch note, and
  --backfill --write verified through git log.
• Every report assertion now pins --today; CONTRIBUTING.md §3 says so.
• The test job re-runs the CLI suite under TZ=Pacific/Kiritimati, a timezone
  that is already tomorrow — a backstop for the next assertion of that shape.
• Verified locally: fmt, clippy -D warnings, cargo doc with
  RUSTDOCFLAGS=-D warnings, MSRV 1.88 cargo check --locked, the same clippy
  and doc gates cross-compiled to x86_64-pc-windows-msvc, and 25 sequential
  release runs of the whole suite.

Checklist

• cargo fmt --all, cargo clippy --all-targets --all-features -- -D warnings, cargo test
• CHANGELOG.md updated under [Unreleased]
• Tests for every behavioural change
• Docs updated: README.md, docs/ART.md, docs/DESIGN.md §11, CONTRIBUTING.md §3, action/README.md