format: a setting value is spelled the way the format declares it - #39

Closes the two voice refusal recorded as O168 - and the measurement that
went with it found something larger, so this fixes that instead.

What was wrong

The registry compared a closed set with EqualFold and a boolean with
ToLower. A value the declaration does not contain therefore passed the
one check meant to stop it and reached the generator, and what happened
next was each generator's own decision.

Measured across all eight formats that declare a closed set, twenty one
settings, every declared value offered in a case the declaration does not
use. Zero of them were refused by the registry. Four behaviours, none
of them declared:

--set entry_owner=USER produced an archive owned by nobody - byte for
byte the default file - with exit 0 and nothing said. --set encryption=NONE went on to demand a password to lock an archive "with
NONE", quoting a value the format does not have.

What this does

• Property.Allows compares exactly. One place, rather than twenty one
  settings, and no generator is ever handed a value its declaration does
  not spell.
• ReadOwnership gains the default branch it never had. The registry
  stops a misspelling earlier now, so this is about the other door: the
  function is callable directly, and silence there is the same wrong file.
• targz records entry_mode and entry_owner in the manifest. Neither
  reached it before - which is exactly why a swallowed owner was
  invisible: a run asking for user and a run asking for USER produced
  identical manifests.

Breaking, and named as such in the changelog

--set page_size=A4 and --set directory_entries=TRUE used to work and
now refuse with exit 4. No file changes its bytes. A recipe writing
header: true is unaffected, because a YAML boolean arrives as true
either way - only a value quoted into another case is refused.

Guards

Three, in internal/guard/closedsets_test.go, all red before the change:
63 values walked from the registry itself rather than from a list copied
beside it, plus the 14 values that carry no letters, counted and printed
so that a day when this guard walks nothing is a day it says so.

Five mutation entries, all caught. One existing entry went stale on this
change and was repaired - staleness.py is clean at 724.

Full suite green (internal/guard 297.9s), preflight green on ten gates
including staticcheck, lint and govulncheck.

🤖 Generated with Claude Code