runtime: make string builtins binary-safe (slen-aware)

[samuelSavanovic]

Summary

Six VAL_STRING ops were using strlen/strcmp/strstr/strncmp and silently truncated at the first embedded NUL. Strings in Gem carry an explicit slen and are documented as binary-safe — these were violating that invariant.

Found via a runtime audit. Memory-safety audit on the same pass came back clean (all reported findings were false positives — stb_ds idioms, arena-reset timing, deep-copy semantics on send were all correct).

Fixes

Op	File	Change
gem_val_eq	runtime/gem_core.c	memcmp + length compare
gem_lt	runtime/gem_ops.c	lexicographic memcmp with length tiebreak
sort default cmp	runtime/gem_builtins_collection.c	same pattern as gem_lt
sqlite3_bind_text	runtime/gem_builtins_sqlite.c	pass v.slen instead of -1 (sqlite was calling strlen internally)
path_join	runtime/gem_builtins_io.c	explicit-length concat, no strcpy/strcat
str_replace	runtime/gem_builtins_string.c	memcmp scan instead of strstr/strncmp

Skipped input() (gem_builtins_core.c:479) — reads interactive lines via fgets, embedded NULs aren't a sensible input there.

Test plan

• make test — 120 examples pass (was 119; new 93_binary_safe_strings.gem covers all six fixes with 12 assertions)
• Equality past \0: "x\0y" == "x" is now false
• Ordering past \0: "x\0y" < "x\0z" is now true
• sort ordering past \0
• str_replace finds patterns containing \0
• path_join preserves bytes past \0 in either argument
• make build clean — no compiler source changes, so no bootstrap needed