Build tooling work, commits C52-C65, C65a, C65b: shared builder and harness modules

[KubaO]

Finishes the command-line migration with tbdocs, folds the builder's and the harness's duplicated helpers into shared modules, and removes a pdf-lib shim that patched a function pdf-lib never calls.

• cli: tbdocs now parses through lib/cli.mjs (builder/command-line.mjs), so every tool in the repository does. Its usage errors keep exit code 4, outside the link-check bitmask. check_cli grows to 254 checks (49 probes, 205 recorded cases, 30 of them for tbdocs).
• builder: shared modules replace copies:
  • builder/url.mjs holds the URL helpers the build and crawl_check used to write separately.
  • builder/escape.mjs holds the HTML, XML and RegExp escapers.
  • builder/code-guard.mjs holds the one <code>/<pre> guard, replaceOutsideCode.
  • builder/baseline.mjs is the one drift guard behind the page-count and symbol-index baselines.
  • Five smaller duplicates fold into paths.mjs, nav.mjs and vendor-assets.mjs.
  • cpu-worker.mjs's three timed task paths share one runner.
• builder: the three whole-page HTML rewrites (void tags, empty table cells, heading anchors) now skip <code> and <pre>, through replaceOutsideCode. check_code_regions has probes for each.
• builder: tbdocs's exit bits are named constants (EXIT_FAILED, EXIT_INTEGRITY, EXIT_COMMAND_LINE), set in one place and shared with serve.mjs.
• test.bat: check_regex_safety follows relative imports, so a regex built from an imported escaper or constant is still analysed. The new check_twin_parsers gate (121 probes) checks that the three scanners of twinBASIC source share one modifier list and one declaration classifier (scripts/lib/twin-declarations.mjs), and that they read the shapes each once misread. test.bat is thirteen steps, and the shared CI action runs the new gate.
• scripts: the twinBASIC harness shares its helpers:
  • One logicalLines for twinBASIC source.
  • One control-clicking module, scripts/lib/tb-click.mjs, which the build icon now goes through too.
  • One COMPILE_TIMEOUT, used at eight sites.
  • One pair of registry helpers.
• test: all ten add-in test files are written in one scenario() frame (test/addin/scenario.mjs), and six of them read the Debug Console through one linesSince. A lane now fails when closing it finds a compiler crash or a javascript dialog. Before, the close ran in an after hook, and node --test exits 0 when an after hook throws, so such a lane passed.
• book: fast-inflate.mjs is deleted. It replaced pako.inflate, which pdf-lib 1.17.1 never calls: a load decodes the cross-reference and object streams through pdf-lib's own FlateStream. pako is no longer a direct dependency (pdf-lib still installs 1.0.11 for itself). Two renders of the same book.html, before and after, have the same 2,298 pages, the same outline and the same size, and differ only in their /CreationDate and /ModDate.
• Docs (Builder.md, Tools.md, Building.md, Fixes-PDFLib.md, Pipeline-Stages.md) and the WIP notes are updated to match.

build.bat, check.bat, test.bat and lint ran clean at each commit, and compare_trees showed each refactor leaving the built site unchanged (recorded in builder/PLAN-TOOLING-REVIEW.md). On BETA 987, examples.bat compiles 1,134 of 1,134 samples and addin-test.bat passes 10 of 10 lanes.