style: remove em/en dashes repo-wide, add CLAUDE.md rule against them (#890)

Em dashes (—) and en dashes (–) had spread across comments, docs, tests,
and a few UI strings, reading as AI-generated boilerplate rather than
house style. Replaced each with punctuation matching its context: colon
for explanatory clauses, comma for asides, plain hyphen for numeric/legal
ranges (e.g. "21-23§"), "to"/"till" for date ranges, parentheses for
paired-dash asides. messages/en.json and messages/sv.json were fixed by
hand together to keep sv/en in sync.

Left untouched where the dash is the functional subject rather than
decorative punctuation: date-range-parser.ts's separator regex,
charset-repair.ts's CP1252 byte-mapping table (and its test), the SIE
encoding mojibake docs, generic-csv.ts's minus-sign normalizer, the
agent system-prompt files that already instruct against em dashes, and
a golden iXBRL test fixture compared byte-for-byte.

Also fixes two bugs surfaced along the way: an off-by-one in
ApiKeysPanel's scope-label split (a leftover from an earlier partial
pass), and a charset-repair test that had lost the literal en-dash it
exists to verify.

Regenerated the agent atom seed migration (skills:generate) since 27
SKILL.md files changed. Added a CLAUDE.md rule against em/en dashes,
with an explicit carve-out for the functional-dash cases above.

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

.github/workflows/docker-publish.yml

@@ -85,15 +85,15 @@ jobs:
         id: trivy
         # Decoupled from the publish gate on purpose: this pipeline must stay
         # green so builds are deterministic. The image is already pushed and
-        # signed above, so failing here would only redden the run — it would not
+        # signed above, so failing here would only redden the run: it would not
         # unship a vulnerable image. exit-code:0 + continue-on-error keep CVEs
         # (and even a Trivy/DB outage) from failing the build; findings still
         # flow to the Security tab below. The real blocking gate is
         # docker-image-scan.yml, which re-scans the published image and fails
         # (notifying admins) on a fixable CRITICAL/HIGH CVE. It runs on a
-        # workflow_run trigger the moment THIS workflow completes — so the gap
+        # workflow_run trigger the moment THIS workflow completes (so the gap
         # between publish and the blocking scan is the scan's own duration
-        # (minutes), not a 24h cron window — plus a daily cron as a safety net.
+        # (minutes), not a 24h cron window) plus a daily cron as a safety net.
         # Accepted residual risk: an image is live for that short scan window
         # before the gate fires; see SELF-HOSTING.md / the risk register.
         continue-on-error: true
@@ -107,7 +107,7 @@ jobs:
           output: trivy-results.sarif
 
       - name: Upload Trivy results to GitHub Security tab
-        # if: always() — evidence must reach the Security tab regardless of the
+        # if: always(), evidence must reach the Security tab regardless of the
         # scan step's exit status. With the previous `outcome == 'success'` guard,
         # a Trivy/DB outage that errored the scan would silently drop findings.
         # Kept non-fatal (continue-on-error) so a missing SARIF or a Security-tab