fix(config): address P3 config-batch audit findings

Parallel-agent audit of the config batch found:

- cycle_bullets used find_marker_span's third element as an indent column, but
  it's the ABSOLUTE byte offset after the marker — so depth (and the rotated
  glyph) was wrong for any item not near offset 0 (tests passed by coincidence).
  Fixed to use the marker span's column (the indentation). Regression test now
  places the list deep in the document.

- :VimwikiColorize interpolated the colour into the template via an unescaped
  replacement: Lua gsub treats `%` specially, Vim substitute() treats `&`/`\`.
  Lua now uses a function replacement (verbatim); Vim escapes `\&~`.

- render_swapped_table applied table_reduce_last_col before the column swap, so
  a swap involving the last column moved the narrow slot — now clamped after.

- Fixed a stale toc_link_format doc comment (format 1 = [[#anchor]], not a
  full parent path).

Verified-correct by the audit (no change needed): RSS rfc822/cdata/fidelity,
prune_orphan_html reverse-mapping + guards, write_escaped_allowing/match_allowed_tag
(multibyte-safe), substitute_emoji (byte-boundary-safe), resolve_target_uri
create_link/dir_link ordering, all config defaults + From/constructors.

Full rust suite + clippy clean; Neovim 307, Vim 301/18/21.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

autoload/nuwiki/commands.vim

@@ -1089,7 +1089,9 @@ function! nuwiki#commands#colorize(...) abort
   " __COLORFG__ replaced by the colour. Configurable via g:nuwiki_color_tag_template.
   let l:tpl = get(g:, 'nuwiki_color_tag_template',
         \ '<span style="color:__COLORFG__">__CONTENT__</span>')
-  let l:tpl = substitute(l:tpl, '__COLORFG__', l:color, 'g')
+  " Escape `\`, `&`, `~` so a colour containing them isn't treated as a
+  " substitute() replacement metacharacter.
+  let l:tpl = substitute(l:tpl, '__COLORFG__', escape(l:color, '\&~'), 'g')
   let l:parts = split(l:tpl, '__CONTENT__', 1)
   let l:open_tag = get(l:parts, 0, '')
   let l:close_tag = get(l:parts, 1, '')