Reject corrupted document titles before writes

[MaggieAppleton]

The Planner could save a title containing NUL and other control bytes, producing a corrupted heading and URL. Reject damaged title text before title normalization and persistence, keeping the previously committed document intact.

The guards cover Planner title drafts, explicit rename, document creation, structural edits, rewrites, and browser Yjs updates. Browser validation follows the known title node even if it moves or changes heading level. Previously stored corrupt titles remain readable and can be repaired by an explicit rename.

Deleting the known title inserts a blank H1 while preserving an unchanged existing body H1, including legacy damaged text in that body heading. New or changed title proposals still pass the corruption guard.

Validated on source commit 9c9ddd8a3 (the final head adds only lane memory metadata):

• 119 focused dialect, Planner, title, collaboration, and title-staging tests pass. The title-deletion regression was observed failing before the fix and now verifies the unchanged epoch and persisted body.
• bun run fix, bun run types, and bun run ci pass.
• Independently reviewed, including moved, retagged, and replacement title bypass attempts.
• All 24 GitHub checks pass on final head 3544d06fa (CI run). The downloaded browser summary records no failures: 22 design, 17 diagram, and 863 integration tests passed on the first attempt; one responsive-workspace reduced-motion test passed on retry after its 100 ms assertion timed out. Eleven browser cases were skipped.

Validation boundary