git-credential-mosaic: escape the escalation record, and stop naming a record that was never written

Both defects found in review by rev-code-01 on #1311.

F3 — the JSONL record interpolated every field with a bare %s. An identity comes
from git config or the environment and a cwd is whatever directory git ran in, so
either can contain a quote or a backslash. One such refusal turned the day's spool
into unparseable JSONL, and the operator would only discover it while reading the
record that explains an outage. Fields are now JSON-escaped.

F2 — the diagnostic printed "record: <spool>/<date>.jsonl" unconditionally, but
the record is only written inside the branch where mkdir -p succeeded. When the
spool cannot be created the helper named a file that does not exist, on exactly
the hosts where the escalation was lost. It now reports the real path or says
NOT WRITTEN.

Also: prettier on README.md, which was the format-step failure on pipeline 2508.
It reflowed only the two tables this branch added.

Tests: cases 14 and 15 cover both. Verified discriminating — against the previous
helper with these same tests, case 14 fails with the unparseable record printed
and case 15 fails on both assertions; against this one both pass.

The first draft of case 14 used `ls "$spool"/*.jsonl | head -1`, which under
`set -o pipefail` exits 2 on a missed glob and killed the suite with zero output
— the same silent-nonzero failure rev-code-01 hit from a partial tools/ extraction
and the reason this file exists. Replaced with a glob loop and a comment.

packages/mosaic/framework/tools/git/README.md

@@ -55,10 +55,10 @@ identity**:
 
 The store is chosen by what the identity **is**, not by which file happens to exist first:
 
-| The identity | Its credential is read from |
-| --- | --- |
-| has a directory at `<brain>/fleet/agents/<id>/` — it is a **seat** | `<brain>/fleet/agents/<id>/secrets/gitea-{usc,mosaicstack}-<id>.token` |
-| does not — it is a **service identity** | `~/.config/mosaic/secrets/gitea-tokens/gitea-{usc,mosaicstack}-<id>.token` |
+| The identity                                                       | Its credential is read from                                                |
+| ------------------------------------------------------------------ | -------------------------------------------------------------------------- |
+| has a directory at `<brain>/fleet/agents/<id>/` — it is a **seat** | `<brain>/fleet/agents/<id>/secrets/gitea-{usc,mosaicstack}-<id>.token`     |
+| does not — it is a **service identity**                            | `~/.config/mosaic/secrets/gitea-tokens/gitea-{usc,mosaicstack}-<id>.token` |
 
 `<brain>` is `MOSAIC_BRAIN_HOME` if set, else `~/.mosaic` — the same resolution
 `packages/mosaic/src/fleet/brain-home.ts` performs.
@@ -71,12 +71,12 @@ revoked token and sends whoever debugs it to the wrong place.
 
 ### What happens when nothing resolves
 
-| identity resolves | token in its store | host runs a fleet | result |
-| --- | --- | --- | --- |
-| yes | yes | — | that identity + token |
-| yes | no | — | **fail closed** |
-| no | — | yes | **fail closed** |
-| no | — | no | shared account, unchanged |
+| identity resolves | token in its store | host runs a fleet | result                    |
+| ----------------- | ------------------ | ----------------- | ------------------------- |
+| yes               | yes                | —                 | that identity + token     |
+| yes               | no                 | —                 | **fail closed**           |
+| no                | —                  | yes               | **fail closed**           |
+| no                | —                  | no                | shared account, unchanged |
 
 A host "runs a fleet" when `<brain>/fleet/agents` exists — the same signal `brain-home.ts`
 uses to decide a brain is active.