datalog: anonymous _ vars are unique per occurrence (Phase 5d, 156/156)

(p X _), (p _ Y) — the two _ are now different variables, matching
standard Datalog semantics. Previously both _ symbols were the same
SX symbol, so unification across them gave wrong answers.

Fix in db.sx: dl-rename-anon-term + dl-rename-anon-lit walk a term
or literal and replace each '_' symbol with a fresh _anon<N>.
dl-make-anon-renamer returns a counter-based name generator scoped
per call. dl-rename-anon-rule applies it to head and body of a
rule. dl-add-rule! invokes the renamer before safety check.

eval.sx: dl-query renames anon vars in the goal before search and
filters '_' out of the projection so user-facing results aren't
polluted with internal _anon<N> bindings.

The previous "underscore in head ok" test now correctly rejects
(p X _) :- q(X) as unsafe (the head's fresh anon var has no body
binder). New "underscore in body only" test confirms the safe
case. Two regression tests for rule-level and goal-level
independence.

lib/datalog/eval.sx

@@ -368,21 +368,26 @@
     (db goal)
     (do
       (dl-saturate! db)
+      ;; Rename anonymous '_' vars in the goal so multiple occurrences
+      ;; do not unify together. Keep the user-facing var list (taken
+      ;; before renaming) so projected results retain user names.
       (let
-        ((substs (dl-find-bindings (list goal) db (dl-empty-subst)))
-          (vars (dl-vars-of goal))
-          (results (list)))
-        (do
-          (for-each
-            (fn
-              (s)
-              (let
-                ((proj (dl-project-subst s vars)))
-                (when
-                  (not (dl-tuple-member? proj results))
-                  (append! results proj))))
-            substs)
-          results)))))
+        ((user-vars (filter (fn (n) (not (= n "_"))) (dl-vars-of goal)))
+          (renamed (dl-rename-anon-lit goal (dl-make-anon-renamer))))
+        (let
+          ((substs (dl-find-bindings (list renamed) db (dl-empty-subst)))
+            (results (list)))
+          (do
+            (for-each
+              (fn
+                (s)
+                (let
+                  ((proj (dl-project-subst s user-vars)))
+                  (when
+                    (not (dl-tuple-member? proj results))
+                    (append! results proj))))
+              substs)
+            results))))))
 
 (define
   dl-project-subst