Extend C-095 to the RFC 8259 control-character escape rule

[O6lvl4]

What

Requirements-first half of almide/almide#2802. json.stringify / value.stringify / json.stringify_pretty escaped only \ " \n \r \t, so every other U+0000–U+001F came out raw. RFC 8259 §7 forbids that, and a strict parser such as Python's json.loads rejects it.

• C-095 statement: the "canonical 5-escape rule" sentence becomes the RFC 8259 §7 rule. The short escapes cover \\ \" \n \r \t. Every other U+0000..U+001F is written as \u00xx in lowercase hex, with no \b / \f short forms. Everything else, U+007F included, stays raw UTF-8. An EXTENDED (#2802) clause records what the old output was and how it surfaced. The title is unchanged, and the ALS-D6 prose does not state the escape rule, so it is untouched and its validation hash stays valid.
• Evidence: new fixture spec/wasm_cross/json_stringify_control_chars.almd (C-095). It runs each of the 32 control characters plus ", \ and U+007F, as a value and as a key, through compact, pretty and value.stringify. Each output is parsed back with json.parse.
• Reference evaluator: ref/src/value.rs json_quote follows the same rule. On the new fixture its output is byte-identical to the implementation's fixed native, structural-wasm and incumbent-wasm legs (checked locally against the almide fix branch).

Local gates: check-contracts, contract-provenance, element-coverage, links, als-style, als-validation, gate-verification, ref-kernel, ref-totality (no new abstain), ref-independence, selftest-conformance, runner-coverage. All green.

Author / verifier record

role	who (human handle, or agent + session)	independent of the author?
authored	Claude (agent, Claude Code session for almide#2802)	—
verified	Claude (same session): local gates + ref vs implementation byte comparison	no

Ratchets loosened in this PR (ceiling up / floor down): none.