sec(archera): residual key-disguise shapes in archeraSafeError error masking #2171

Residual, non-blocking findings from the cli #2166 gate (PR merged at 1194b60; owner mutation policy: follow-ups only). All are adversarial-only shapes in archeraSafeError (cmd/archera_comparison.go); no accidental vendor format produces them.

1. Irregular separators that alternate lengths, with one over the gap bound, are shown (for example -/---, --/----, 0x0/x0x0). Idea: collapse runs of a single repeated key-alphabet rune before the gapped check.
2. A separator longer than archeraMaxSep (17 dashes) is shown; the key then spans about 700 bytes so the 512-byte cap shows only part of it.
3. Confusables (Cyrillic Т, dotless ı) are not folded (documented in code).
4. Surviving mutants from the gate sweep at 0230025: message skeleton keeping Mn/Me, Hangul fillers or U+FFFD has no test with a 3-rune invisible separator; gap-ignores-order only over-withholds.

Related: owner decision item 61 (stop echoing vendor error text in the CLI/MCP, which would make 1-3 moot). Also pending: bump the go pin (cli pins 73d3366) to the insurance.Secret version.