Follow core's rename of format to unsafe-format

[hellerve]

Carp core is renaming the format interface to unsafe-format (carp-lang/Carp#1432: format is a thin single-argument printf wrapper with no check that the string carries exactly one directive). Merge after that lands; until then CI is red because unsafe-format does not exist yet.

• the three spawn-failure messages in the test suite become unsafe-format
• the two calls in examples.md follow
• reflowed by carp-fmt where the longer name crossed the wrap column

10/10 green against a local core carrying the rename. The two pre-existing not-equal angler findings in the test suite are untouched.