fix: mark tags fmt cannot format safely instead of crashing (#197)

[linkdata]

Fixes #197.

Problem

tag.TagString formatted tags with fmt's %#v and wire.Message.String formatted Dest with %v. Neither verb detects reference cycles, so a self-referential tag list recurses until the runtime aborts the process with fatal error: stack overflow — unrecoverable, from valid input. Confirmed empirically for a cyclic []any, a value-struct-through-slice cycle, and a cyclic map (pointer cycles are safe — fmt prints an address). A compact value that expands exponentially makes fmt buffer 1.3 GB.

Approach

Detect, then delegate. A small pre-check (formatSafe) decides before calling fmt whether a value is safe to hand over — necessary because fmt builds its whole output in an internal buffer before writing, so neither a bounded io.Writer nor recover can contain the overflow or the memory blow-up (both verified). The check walks the value the way fmt does:

• fmt.Formatter / fmt.GoStringer / fmt.Stringer values are leaves (fmt calls the method, doesn't recurse structure);
• a pointer is descended only at the top level (fmt prints deeper pointers as addresses), so ordinary pointer-linked tags aren't misflagged;
• recursion depth is bounded — a reference cycle is simply an unbounded-depth walk, so a depth cap catches every cycle with no active-node bookkeeping (this also means acyclic slice aliases like s[:1] are never misread as cycles);
• estimated output size is bounded, including the %#v type string (which reflect.StructOf can make enormous), catching exponential/huge blow-ups;
• a top-level reflect.Value is unwrapped first, matching fmt.

A value that passes is handed to fmt unchanged — every ordinary acyclic tag formats exactly as before, custom formatters (including redaction) included, and Message.String keeps its precise %v output. A value that fails renders as the marker cyclic-tag instead of crashing.

TagString and Message.String share the logic through the new tag.FormatValue(v, goSyntax) — the fmt-path analogue of the cycle detection TagExpand/expand already use for tag expansion. As with TagExpand, formatting methods reachable from the value must terminate and not mutate the graph (documented precondition).

Tests & benchmarks

Covers the issue reproduction and the cyclic struct/map/array/unexported and reflect.Value cases (all → cyclic-tag, no crash), the exponential-graph / huge-shared-string / huge-reflect.StructOf-type-name blow-ups, the depth cap, pointer cycles and large/aliased acyclic slices (not flagged — still byte-identical to fmt), and custom Formatter/GoStringer/Stringer/error handling (including a >1 MiB string-backed redactor). A benchmark guards the deep-chain path that a naive active-node scan made quadratic (~2.9 s → 1.1 µs / 0 allocs). 100% statement coverage of the new code; go vet, gofumpt, staticcheck, golangci-lint (0 issues) and go test -race ./... all pass.