datalog: anonymous _ vars are unique per occurrence (Phase 5d, 156/156)

(p X _), (p _ Y) — the two _ are now different variables, matching
standard Datalog semantics. Previously both _ symbols were the same
SX symbol, so unification across them gave wrong answers.

Fix in db.sx: dl-rename-anon-term + dl-rename-anon-lit walk a term
or literal and replace each '_' symbol with a fresh _anon<N>.
dl-make-anon-renamer returns a counter-based name generator scoped
per call. dl-rename-anon-rule applies it to head and body of a
rule. dl-add-rule! invokes the renamer before safety check.

eval.sx: dl-query renames anon vars in the goal before search and
filters '_' out of the projection so user-facing results aren't
polluted with internal _anon<N> bindings.

The previous "underscore in head ok" test now correctly rejects
(p X _) :- q(X) as unsafe (the head's fresh anon var has no body
binder). New "underscore in body only" test confirms the safe
case. Two regression tests for rule-level and goal-level
independence.

lib/datalog/scoreboard.json

@@ -1,13 +1,13 @@
 {
   "lang": "datalog",
-  "total_passed": 153,
+  "total_passed": 156,
   "total_failed": 0,
-  "total": 153,
+  "total": 156,
   "suites": [
     {"name":"tokenize","passed":26,"failed":0,"total":26},
     {"name":"parse","passed":18,"failed":0,"total":18},
     {"name":"unify","passed":28,"failed":0,"total":28},
-    {"name":"eval","passed":15,"failed":0,"total":15},
+    {"name":"eval","passed":18,"failed":0,"total":18},
     {"name":"builtins","passed":19,"failed":0,"total":19},
     {"name":"semi_naive","passed":8,"failed":0,"total":8},
     {"name":"negation","passed":10,"failed":0,"total":10},
@@ -15,5 +15,5 @@
     {"name":"api","passed":9,"failed":0,"total":9},
     {"name":"demo","passed":10,"failed":0,"total":10}
   ],
-  "generated": "2026-05-08T08:49:52+00:00"
+  "generated": "2026-05-08T08:57:57+00:00"
 }