Fix stdlib.sx: trim to safe subset, fix escape-html transpilation

The full stdlib migration revealed constraints:
- Replacing native callables with SX lambdas changes CEK continuation
  capture behavior (breaks shift/reset tests)
- The transpiler doesn't support named-let (breaks range, split, etc.)
- Platform-internal functions (nil?, isNil) can't be shadowed

Safe subset in stdlib.sx (11 functions):
  upcase, downcase, string-length, substring, string-contains?,
  starts-with?, ends-with?, pluralize, escape, parse-datetime, assert

Fix escape-html in render.sx: replace -> (thread-first) with let/set!
since the JS transpiler can't handle -> in spec files.

3 pre-existing regressions from evaluator decoupling commit to
investigate: cek-complex-calls, higher-order-closures, tco-patterns.

Python 744/744 clean. JS 954/957 (3 pre-existing).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

spec/render.sx

@@ -249,11 +249,12 @@
 
 (define escape-html
   (fn (s)
-    (-> (str s)
-      (replace "&" "&")
-      (replace "<" "&lt;")
-      (replace ">" "&gt;")
-      (replace "\"" "&quot;"))))
+    (let ((r (str s)))
+      (set! r (replace r "&" "&amp;"))
+      (set! r (replace r "<" "&lt;"))
+      (set! r (replace r ">" "&gt;"))
+      (set! r (replace r "\"" "&quot;"))
+      r)))
 
 (define escape-attr
   (fn (s)