fix(diagnostics): bound formatting and release ingress before callbacks

Bound UTF-8 formatting and release diagnostic ingress before invoking
callbacks. Check error-ID collisions at Rust/C++ release final link.

Validation: diagnostic tests, strict Clippy, Miri and final-link cases.

firmware/libs/kaptan-err-reportable-macros/tests/final_link.md

@@ -0,0 +1,28 @@
+# Cross-crate error-ID final-link checks
+
+From the repository root, run `nix develop -c make -C firmware native-test`.
+For a separate artifact directory:
+
+```sh
+nix develop -c env CARGO_BUILD_JOBS=2 python3 firmware/libs/kaptan-err-reportable-macros/tests/final_link.py \
+  --work-dir /tmp/kaptan-final-link
+```
+
+The fixture builds two crates using the production `KaptanError` derive as
+rlibs and staticlibs. Rust and C++ executables cover unique and duplicate IDs,
+used and unused error values, and an unused second crate. Successful executables
+must run. Expected duplicate failures must name `__kaptan_error_id_65401`.
+
+The helper seeds its fixture lock from `firmware/Cargo.lock`, verifies registry
+versions, sources and checksums, then builds with Rust 1.90.0 and `--locked
+--offline`. It retains source, manifests, locks, binaries, linker output and
+`results.txt` with the Rust compiler identity and all twelve outcomes. Native linker flags
+are Linux-specific.
+
+The exported `#[used]` marker detects collisions when both defining objects
+participate in the link. It cannot force extraction of an unreferenced staticlib
+member. The native case that calls only the first crate can therefore link despite
+the duplicate ID. Rust's release-LTO fixture explicitly names the second crate
+and rejects that collision. These cases do not establish catalog-wide uniqueness
+across every supplied archive or every embedded linker/LTO combination. Stable
+error-ID allocation still requires review.