Update RON v1 string escaping semantics

[delaneyj]

The RON reference is correcting string escaping within RON v1. This is intentionally not a v2 change.

Every RON string token must decode the JSON escape set, independent of presentation:

• bare, single-quoted, double-quoted, and repeated-delimiter strings
• comma-prefixed strings
• object keys and values
• \", \\, \/, \b, \f, \n, \r, \t, and \uXXXX

Literal backslashes now require \\. Unknown/truncated escapes, unpaired surrogates, raw C0 string content, and raw double-quote content must fail. Exact unescaped true, false, null, and JSON numbers classify before decoding; escaped spellings remain strings. Decode keys before duplicate-key comparison.

Rendering must JSON-escape double quote, backslash, and C0 controls before deciding whether the encoded content can remain bare. Slash remains unescaped in canonical output; other Unicode remains UTF-8.

Current impact:

• src/Scanner.php scans and returns string bytes without escape decoding.
• src/RonRenderer.php emits raw backslashes and controls.
• Regex RON such as ^foo\d+$ must become ^foo\\d+$ to preserve the same value.

Acceptance:

• Update the RON corpus submodule and consume the revised testdata/conformance/manifest.json.
• Pass the new basic/escapes and basic/comma_escapes cases.
• Reject every new escape/raw-control invalid fixture.
• Match revised canonical RON bytes and SHA-256 hashes.
• Keep this correction labeled RON v1.