Follow core's rename of format to unsafe-format

[hellerve]

Carp core is renaming the format interface to unsafe-format (carp-lang/Carp#1432: format is a thin single-argument printf wrapper with no check that the string carries exactly one directive). Merge after that lands; until then CI is red because unsafe-format does not exist yet.

• CLI.Type.format becomes CLI.Type.unsafe-format and implements unsafe-format. It takes a caller-supplied &String and forwards it to printf unchecked, so it inherits the hazard in full; a comment now says so
• Long.format / Double.format / String.format call sites follow
• reflowed by carp-fmt where the longer name crossed the wrap column

204/204 green against a local core carrying the rename.