Preserve malformed path provenance safely

[chubes4]

Summary

• reject raw invalid UTF-8 artifact paths at the canonical safe-path boundary
• retain malformed percent-encoded bytes as canonical ASCII provenance before runtime declaration hashing
• reject encoded separators even when malformed byte escapes are retained

Verification

• retained private artifact: full staged preparation, compilation, and composition completed for 114 pages
• PHP artifact, site-plan, and path contracts
• PHP transformer parity: 305 fixtures
• package proof
• package typecheck/build/test: 104 files and 499 tests

Depends on #1644.

Fixes #1645

AI Assistance

OpenAI gpt-5.6-terra via OpenCode implemented, tested, and self-reviewed this change under Astra orchestration.