datalog: reject reserved relation names as rule/fact heads (246/246)

Real bugs surfaced by parser/safety bug-hunt round:
- `not(X) :- p(X).` parsed as a regular literal with relation
  "not". The user could accidentally define a `not` relation,
  silently shadowing the negation construct.
- `count(N, X, p(X)) :- ...` defined a `count` relation that
  would conflict with the aggregate operator.
- `<(X, 5) :- p(X).` defined a `<` relation.
- `is(N, +(1, 2)) :- p(N).` defined an `is` relation.
- `+.` (operator alone) parsed as a 0-ary fact.

Fix: dl-add-fact! and dl-add-rule! now reject any literal whose
head's relation name is in dl-reserved-rel-names — built-in
operators (< <= > >= = != + - * /), aggregate operators
(count sum min max findall), `is`, `not`, and the arrows
(:-, ?-).

4 new eval tests cover the rejection cases.

Note: an initial "no compound args in facts" check was overly
strict — it would reject findall's list output (which derives a
fact like (all_p (a b c))). Reverted that branch; treating
findall results as opaque list values rather than function
symbols.

lib/datalog/scoreboard.md

@@ -1,13 +1,13 @@
 # datalog scoreboard
 
-**242 / 242 passing** (0 failure(s)).
+**246 / 246 passing** (0 failure(s)).
 
 | Suite | Passed | Total | Status |
 |-------|--------|-------|--------|
 | tokenize | 26 | 26 | ok |
 | parse | 20 | 20 | ok |
 | unify | 28 | 28 | ok |
-| eval | 32 | 32 | ok |
+| eval | 36 | 36 | ok |
 | builtins | 23 | 23 | ok |
 | semi_naive | 8 | 8 | ok |
 | negation | 10 | 10 | ok |