Escape TOML strings and reject unparsable widget names

[GG-O-BP]

Summary

• mendraw#8 reported unescaped TOML string writing in the old generator. The successor writers in mxpak (config/toml_writer, lockfile) had the same flaw: raw interpolation of version/hash/S3 strings into quoted TOML.
• A shared mxpak/toml_syntax module now emits TOML basic-string escapes (\", \\, \b, \t, \n, \f, \r, control \uXXXX) and correctly quotes bare/quoted keys; both writers use it.
• Round-trip tests write hostile versions/S3 IDs and read them back through the real tom parser.
• Investigation also showed the tom parser cannot round-trip quoted keys containing escaped quotes, so widget.validate_name now rejects quotes (alongside separators/NUL) to keep mxpak.lock readable.

Fixes glendix-labs/mendraw#8

Verification

• gleam test — 114 passed.
• ./scripts/verify.sh inner mxpak — passed.
• ./scripts/check-all.sh — passed.
• pre-push verify.sh final — passed (family checks, widget build, Lustre E2E, Mendix full E2E).