Fix the fence sanitizer: a delimiter shape starting inside a run of angles survived

[stormer78]

The bug

Fence::sanitize looked for <<<, and when the bytes after it were not the
sentinel it emitted <<< and advanced three bytes. A delimiter shape
starting one byte later was therefore never examined.

Confirmed on main before changing anything:

input   "<<<</UNTRUSTED-MEMORY:abc>>>"
output  "<<<</UNTRUSTED-MEMORY:abc>>>"     (byte-for-byte unchanged)

The output still contains <<</UNTRUSTED-MEMORY:abc>>>, starting at offset 1.
<<<<<UNTRUSTED-MEMORY:abc>>> keeps an opening shape the same way.

This was not a working injection: the delimiters carry a per-render 48-bit nonce
from the OS RNG, and content cannot close a fence whose nonce it cannot predict.
That control held. But the module documents shape neutralisation as belt and
braces on top of the nonce, and the belt was not fastened.

Second defect in the same function

A matched opener with no delimiter after it consumed everything up to the next
>>> anywhere in the text:

input   "<<<UNTRUSTED-MEMORY keep this sentence >>> and this"
output  "[redacted-delimiter] and this"

The sentence was silently dropped. Sanitising is meant to defang content so a
person can still read it, not to censor it.

The fix

• After a <<< that does not begin a delimiter, the scan advances one byte.
  < is ASCII, so that is always a char boundary.
• What gets replaced is bounded by the delimiter token's own grammar: <<< or
  <<</, the sentinel, an optional :, at most 64 lowercase hex characters,
  then >>>. A complete token is replaced whole; anything else that starts with
  the prefix loses only the <<< + sentinel prefix, so the text after it
  survives.
• The replacement contains no <, and a token's fourth byte is always / or the
  sentinel's first letter, so no delimiter shape can begin inside a replacement
  either.

Tests

• A proptest over strings built from {<, /, >, sentinel, :, hex, prose}
  asserting the output never contains <<<UNTRUSTED-MEMORY or
  <<</UNTRUSTED-MEMORY, plus idempotence, plus "text with no delimiter shape
  comes back untouched" (drawn from a sentinel-free alphabet rather than filtered,
  so the generator is not rejected into oblivion).
• Unit tests for both bypasses above, for prose after a non-delimiter <<<, for
  an unclosed prefix keeping what follows it, for a malformed or over-long nonce
  losing only the prefix, and for multi-byte text around a candidate.
• proptest is a new dev-dependency (default-features = false, std).

Versions

Plugin and crate versions are bumped in step (0.2.0 → 0.2.1): the sanitizer runs
inside the installed binary, and claude plugin update compares that version,
not the commit.

Checks

cargo fmt --all -- --check, cargo clippy --all-targets --all-features -D warnings and cargo test --all-features — the three commands CI runs.