tools: add verified atomic toit format command

[floitsch]

Part 6 of 10 in the AST-driven Toit pretty-printer stack. Depends on #3190.

Summary

• add the toit format command
• reject input with parse errors
• reparse output and require structural AST equivalence
• verify comment fingerprints before installation
• install changed files atomically
• add public-command gold tests with a second idempotence pass

User-visible formatter behavior lives in gold files. CTests remain limited to mechanisms that cannot be observed through toit format.

Verification

• formatter gold tests pass for expressions, declarations, and comments
• parse-error and verifier-rejection tests pass
• atomic replacement failure tests pass

_{Stack created with GitHub Stacks CLI}