fix(inplace,embed): input set back mid-flight, report inputs, ambiguous anchors

Four items owed after S5b, reported by design-dev during the anti-slop run:

- carry() measured a sent-then-changed form against its OLD DEFAULTS. An
  answer set back mid-flight to the value the page first showed read as
  untouched, and the swap put the just-saved value over it. A form sent and
  then changed is now measured against its sent snapshot (sentSet.snapOf).
- The embed's clean-batch reload saw only our own forms. A report's own
  inputs lost whatever the operator had typed into them. Unsaved text in
  any control we don't own now holds the reload, and the page says so.
- Two r2b.toml rows ("D3 a stored theme...", "D3 forced light...") matched
  twice, so they proved only by where the first match fell. Both are
  re-anchored, and scripts/mutation_check.py now refuses any anchor that
  matches more than once. A new tool control covers that.
- The r2_flow contract's C3 steps 2 and 4 now say what S5b superseded. U3
  gains the report-input rule.

Mutation rows: u3_submit_all +1, r2_submit_all +1. Four rows were
re-anchored onto the moved lines.

docs/contracts/u3_declared_embed_seam.contract.md

@@ -279,6 +279,10 @@ submit on one of our forms F:
                                      operator entered stays on the page.
         A refusal blocks the reload ON ITS OWN: a refused form set back to its
         first value reads clean, and "nothing dirty" alone reloaded over it.
+        So does unsaved input in the REPORT'S OWN controls (amended
+        2026-09-28): any input, textarea or select not owned by one of our
+        forms that differs from its default. The reload would clear it, and
+        ourForms cannot see it.
 ```
 
 Five consequences, each deliberate:
@@ -440,7 +444,9 @@ leave a saved form's baseline where it was and
 `test_a_retry_after_a_refusal_sends_only_what_did_not_save` fails; drop the
 class-level `[hidden]` rule and `test_the_empty_status_line_stays_hidden_under_host_css`
 fails; let "nothing dirty" alone decide the reload and
-`test_a_refusal_blocks_the_reload_even_when_nothing_reads_dirty` fails.
+`test_a_refusal_blocks_the_reload_even_when_nothing_reads_dirty` fails; ignore
+the report's own inputs and
+`test_a_clean_batch_does_not_reload_over_text_typed_into_the_report` fails.
 
 ## Out of scope (deferred or never)