fix(diagnostics): bound formatting and release ingress before callbacks

Bound UTF-8 formatting and release diagnostic ingress before invoking
callbacks. Check error-ID collisions at Rust/C++ release final link.

Validation: diagnostic tests, strict Clippy, Miri and final-link cases.

docs/src/errors.md

@@ -23,8 +23,15 @@ requires a nonzero explicit ID on every variant and retains no type, variant,
 or module string. `Display` renders the decimal ID. Renaming, moving, or
 reordering a Rust variant therefore does not change its receiver contract.
 Missing and same-enum duplicate IDs are rejected by the derive. Reusing an ID
-across error enums generates the same reserved linker symbol and fails the
-final firmware build.
+across error enums generates the same reserved symbol. Collision detection
+requires both defining objects to participate in compilation or final linking.
+It does not inspect unextracted archive members or prove catalog-wide uniqueness.
+Stable ID allocation still requires review.
+
+The [final-link fixture](../../firmware/libs/kaptan-err-reportable-macros/tests/final_link.md)
+checks Rust 1.90.0 release fat-LTO and native Linux static-library links.
+Run it with `make -C firmware native-test`. Each run retains its results and
+Rust compiler identity in `results.txt`.
 
 `#[kaptan_err_reportable::propagate]` turns an annotated function into a
 reporting point. If a reportable `Err` leaves that function, the attribute makes
@@ -76,16 +83,14 @@ different reportable error is already pending.
   `ERROR`, subject to bounded transport admission. The payload is
   `{ error_id, raised_at[96] }`. `raised_at` is a zero-padded UTF-8
   `file:line` prefix for the reporting point.
-  The message kind itself identifies an error; no level is duplicated in the
-  payload. Dynamic human-readable context belongs in `LOG`, while
+  Dynamic human-readable context belongs in `LOG`, while
   structured protocol failures remain in their owning response message.
 - Control, navigation, and safety error types are derive-ready but
   their live owners are not yet attached to a MAVLink worker.
 
-F722 still uses `panic-halt`; it does not claim a live panic frame or
-retained-record replay.
+F722 uses `panic-halt`, without live panic reporting or retained-record replay.
 
 No diagnostic message may synchronously transmit from a panic handler, hard
 fault, ISR, DMA callback, or motor-inhibit path. A later target integration
 must inhibit outputs first, persist a validated crash record, then report it
-only after the next boot’s static board telemetry is available.
+only after MAVLink is available on the next boot.