Cover non-BMP characters, and refuse lone surrogates with LiftWriteError

[imnasnainaec]

Closes #21.

Regression coverage (the gap #21 identified)

Non-BMP characters and UTF-16 sources already behaved correctly; nothing pinned it down. New tests/test_unicode.py:

• byte-identical round trips with non-BMP text in an attribute value, in element text, and inside a <span>
• exact byte-region scanner boundaries across a 4-byte UTF-8 sequence — the input a scanner that guessed at character boundaries would break on
• an untouched non-BMP entry emitted verbatim while its neighbour is edited (raw UTF-8 out, not character references)
• streaming read and write; clean validation
• a � character reference and CESU-8/WTF-8 surrogate halves both rejected as LiftParseError, through the full and the streaming reader — so no lone surrogate can reach the model from a file
• a UTF-16 source carrying non-BMP content loads, re-serializes canonically as UTF-8 (the documented byte-identity exception for a non-ASCII-compatible encoding), and is byte-stable from there on

The property suite drew non-BMP codepoints from st.characters() too rarely to count as coverage, so text and attribute-value alphabets now sample them explicitly, across five planes.

Lone surrogates through the API

A Python string can hold a lone surrogate (U+D800-U+DFFF); an XML document cannot, in any encoding. Since no file can introduce one, it only ever arrives as a string assigned through the API — and then lxml raised a bare UnicodeEncodeError from wherever the text or attribute was set, naming no node, out of four public entry points: save(), changes(), changed_entries(), and validation.

• New LiftWriteError. Every writer path that builds and serializes a node passes through _guarded(), which names the node and the codepoint: entry 'abat': U+D800 is a lone surrogate, which XML cannot represent in any encoding (in 'a\ud800b'). Nothing is written; the model is untouched. Anything else a str cannot encode as UTF-8 — nothing, today — is re-raised rather than mislabelled.
• The digest functions delegate to the canonical byte functions they duplicated, so snapshots are covered too; canonical_range_bytes and _ranges_root_open_bytes replace three copies of those bodies (including a # noqa: E731 lambda).
• Validation renders the document before checking it, so it cannot check an unrenderable one: it reports the refusal as a single lone-surrogate error instead of propagating the encode error — addressed to the companion, and without stopping the .lift's own checks, when a .lift-ranges is the unwritable part.

Not built: substituting or dropping the surrogate on save (silently rewriting lexical data), and rejecting at assignment time (the model is plain slotted dataclasses, so partial coverage would be a promise the library could not keep).

Notes

• docs/en/fidelity.md gains a "Content XML cannot represent" section; docs/en/guides/validate.md cross-references it; LiftWriteError reaches the API reference through mkdocstrings.
• CHANGELOG: folded into the existing [0.1.0] writer bullet rather than [Unreleased], since 0.1.0 has not shipped.
• The CLI's inability to print non-BMP findings on a legacy codepage stdout is Redirected CLI output crashes on characters the locale encoding cannot represent, truncating export #32, untouched here. One coupling: reconfiguring those streams to UTF-8 is enough for non-BMP but not for a lone surrogate, which needs an explicit errors= handler.
• python scripts/check.py green (557 passed, 97.8% coverage); mkdocs build --strict clean.

🤖 Generated with Claude Code

---

Devin review: https://app.devin.ai/review/sillsdev/python-sil-lift/pull/36

---

This change is 

[jasonleenaylor]

@jasonleenaylor reviewed 10 files and all commit messages, and made 1 comment.
Reviewable status: complete! all files reviewed, all discussions resolved (waiting on imnasnainaec).