Actual string formatter precision padding and null-pointer policy

RE-813. Reproduce with python3 scripts/analyze_qvm_format_string.py; focused validation: cargo xtask test-group format-string. Machine report.

96 source fixtures vary NUL placement, opaque bytes, null pointers, width and precision. Actual strlen36038 executes on unbounded-precision paths. Independent byte oracles verify output and cursor advancement. These semantics differ from assuming a standard host printf implementation; central formatting and native/runtime parity remain open.

Original executable/native runtime and complete Linux/macOS Rust/Bevy/Solari acceptance remain unverified.