Safe DOCX posture
Paragraph-mark run-property revisions (w:rPrChange)
safe-docx accepts/rejects w:rPrChange records under paragraph-mark run
properties. Emission is bounded to the supported formatting surfaces; Lean does
not inspect or prove the prior-property snapshot.