datalog: reject reserved relation names as rule/fact heads (246/246)

Real bugs surfaced by parser/safety bug-hunt round:
- `not(X) :- p(X).` parsed as a regular literal with relation
  "not". The user could accidentally define a `not` relation,
  silently shadowing the negation construct.
- `count(N, X, p(X)) :- ...` defined a `count` relation that
  would conflict with the aggregate operator.
- `<(X, 5) :- p(X).` defined a `<` relation.
- `is(N, +(1, 2)) :- p(N).` defined an `is` relation.
- `+.` (operator alone) parsed as a 0-ary fact.

Fix: dl-add-fact! and dl-add-rule! now reject any literal whose
head's relation name is in dl-reserved-rel-names — built-in
operators (< <= > >= = != + - * /), aggregate operators
(count sum min max findall), `is`, `not`, and the arrows
(:-, ?-).

4 new eval tests cover the rejection cases.

Note: an initial "no compound args in facts" check was overly
strict — it would reject findall's list output (which derives a
fact like (all_p (a b c))). Reverted that branch; treating
findall results as opaque list values rather than function
symbols.

lib/datalog/db.sx

@@ -182,6 +182,20 @@
       ((facts (get db :facts)))
       (if (has-key? facts rel-key) (get facts rel-key) (list)))))
 
+;; Reserved relation names: built-in / aggregate / negation / arrow.
+;; Rules and facts may not have these as their head's relation, since
+;; the saturator treats them specially or they are not relation names
+;; at all.
+(define
+  dl-reserved-rel-names
+  (list "not" "count" "sum" "min" "max" "findall" "is"
+        "<" "<=" ">" ">=" "=" "!=" "+" "-" "*" "/" ":-" "?-"))
+
+(define
+  dl-reserved-rel?
+  (fn
+    (name) (dl-member-string? name dl-reserved-rel-names)))
+
 (define
   dl-add-fact!
   (fn
@@ -189,6 +203,9 @@
     (cond
       ((not (and (list? lit) (> (len lit) 0)))
         (error (str "dl-add-fact!: expected literal list, got " lit)))
+      ((dl-reserved-rel? (dl-rel-name lit))
+        (error (str "dl-add-fact!: '" (dl-rel-name lit)
+                    "' is a reserved name (built-in / aggregate / negation)")))
       ((not (dl-ground? lit (dl-empty-subst)))
         (error (str "dl-add-fact!: expected ground literal, got " lit)))
       (else
@@ -301,6 +318,9 @@
         (error (str "dl-add-rule!: expected rule dict, got " rule)))
       ((not (has-key? rule :head))
         (error (str "dl-add-rule!: rule missing :head, got " rule)))
+      ((dl-reserved-rel? (dl-rel-name (get rule :head)))
+        (error (str "dl-add-rule!: '" (dl-rel-name (get rule :head))
+                    "' is a reserved name (built-in / aggregate / negation)")))
       (else
         (let ((rule (dl-rename-anon-rule rule)))
           (let