bind: document lock-held formatting callbacks

[linkdata]

Summary

• document that Binder HTML formatting callbacks run while the supplied lock is held
• add deterministic contract coverage for bind.Formatter, fmt.Formatter, and formatted and default fmt.Stringer paths
• leave the existing Binder lock scope and runtime behavior unchanged

Rationale

Holding the lock preserves one synchronized view throughout value retrieval and formatting. Unlocking after a shallow value copy would allow referenced state to change before or during formatting, introducing a TOCTOU window. Formatting callbacks therefore operate on already-locked state.

Verification

• go generate ./...
• go vet ./...
• gofmt -l .
• staticcheck ./...
• golangci-lint run
• gosec -quiet ./...
• JAWS_REQUIRE_NODE=1 go test -race ./...
• go build ./...
• Linux/386 bind and jawstree test packages cross-compiled locally
• go doc ./lib/bind Binder
• go doc ./lib/bind Binder.Format
• go doc ./lib/bind Formatter

Fixes #136