fix(config): address P3 config-batch audit findings

Parallel-agent audit of the config batch found:

- cycle_bullets used find_marker_span's third element as an indent column, but
  it's the ABSOLUTE byte offset after the marker — so depth (and the rotated
  glyph) was wrong for any item not near offset 0 (tests passed by coincidence).
  Fixed to use the marker span's column (the indentation). Regression test now
  places the list deep in the document.

- :VimwikiColorize interpolated the colour into the template via an unescaped
  replacement: Lua gsub treats `%` specially, Vim substitute() treats `&`/`\`.
  Lua now uses a function replacement (verbatim); Vim escapes `\&~`.

- render_swapped_table applied table_reduce_last_col before the column swap, so
  a swap involving the last column moved the narrow slot — now clamped after.

- Fixed a stale toc_link_format doc comment (format 1 = [[#anchor]], not a
  full parent path).

Verified-correct by the audit (no change needed): RSS rfc822/cdata/fidelity,
prune_orphan_html reverse-mapping + guards, write_escaped_allowing/match_allowed_tag
(multibyte-safe), substitute_emoji (byte-boundary-safe), resolve_target_uri
create_link/dir_link ordering, all config defaults + From/constructors.

Full rust suite + clippy clean; Neovim 307, Vim 301/18/21.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lua/nuwiki/commands.lua

@@ -1219,7 +1219,9 @@ function M.colorize(color, visual)
   local tpl = (require('nuwiki.config').options or {}).color_tag_template
     or vim.g.nuwiki_color_tag_template
     or '<span style="color:__COLORFG__">__CONTENT__</span>'
-  tpl = tpl:gsub('__COLORFG__', color)
+  -- Function replacement returns the colour verbatim (a string replacement
+  -- would treat `%` specially).
+  tpl = tpl:gsub('__COLORFG__', function() return color end)
   local open_tag, close_tag = tpl:match('^(.*)__CONTENT__(.*)$')
   if not open_tag then
     open_tag, close_tag = string.format('<span style="color:%s">', color), '</span>'