Follow core's rename of format to unsafe-format

[hellerve]

Carp core is renaming the format interface to unsafe-format (carp-lang/Carp#1432: format is a thin single-argument printf wrapper with no check that the string carries exactly one directive). Merge after that lands; until then CI is red because unsafe-format does not exist yet.

• the 14 (format "%0Nd" ...) calls in Datetime.strftime become unsafe-format
• Datetime.format becomes Datetime.unsafe-format, and implements unsafe-format
• its docstring now says that this implementation is directive-safe: it expands the first directive and copies the rest of s verbatim, so nothing reaches printf. It carries the interface's name, not its hazard
• reflowed by carp-fmt where the longer name crossed the wrap column

340/340 green against a local core carrying the rename.