fix(cli): guard publish's IO, validate --dtstamp, and list all commands

publish's own mkdir_p/write_file (unlike every other IO path on this
branch) were unguarded: an unwritable --out parent raised a bare
Unix.Unix_error(EACCES,...) and an --out naming an existing file raised
ENOTDIR, both as uncaught exceptions with a stack trace rather than the
project's one-line "colitur: ..." form. The same defect class commit
6bd741b already fixed once for template reads -- --out is user input
too. Fixed by wrapping the whole publish_report call (not each
write_file site) in one handler for Unix.Unix_error and Sys_error,
mirroring why that earlier fix guarded the whole read and not only the
open. Added a cram case using a read-only directory inside the test's
own cram sandbox, not /tmp, so a failed cleanup cannot leave an
unwritable directory behind in a shared location.

--dtstamp was the only user string reaching output unescaped and
unvalidated: "--dtstamp hello" silently emitted an invalid
"DTSTAMP:hello", and a value carrying its own CRLF injected extra lines
into every VEVENT. Fixed by rejecting anything not matching RFC 5545's
UTC form (8 digits, 'T', 6 digits, 'Z') before either emit or publish
does anything else, one line to stderr, exit 2.

usage() was byte-unchanged from before the branch and listed only the
six pre-existing commands, omitting all four commands this branch added
(emit, table, render, publish). Added them; the three cram pins of the
exact usage string are updated to match.

0 files changed, 0 insertions, 0 deletions