PM-78: fix remaining HIGH/MEDIUM findings (H3-H7, M1-M7) and harden tests master
- H3: checked transform arithmetic, optional bounds (no infinities) - H4: ColourCode widened to u32, malformed colour diagnostics - H5: BFC arity validation, NOCERTIFY winding reset - H6: reservation before semantic growth - H7: per-instance reflection (no scene-level XOR) - M1: duplicate MPD filename diagnostic - M2: LineType in GeometryRecord, consistent ColourCode usage - M3: removed dead code (ByteBank, local slots, fmt_num, valid field) - M4: cached numeric token values in scanner - M5: prebuilt include resolution map (no O(n²)) - M7: strict key/value !COLOUR parser - H9-H11: hardened test assertions (rejected fixtures, syntax records, expected record comparison) Epic: PM-86 Task: PM-78