mds-cli: install a panic hook so an internal invariant failure prints one sanitized "internal compiler error" line instead of Rust's default panic text

[dean0x]

Since #220 the compiler enforces several internal invariants with unconditional assert!s. The bindings (crates/mds-napi/src/lib.rs run_catching, crates/mds-wasm/src/lib.rs catch_panic, crates/mds-python/src/lib.rs guard) convert a panic into a typed mds::internal / internal compiler error and hide the payload unless the never-shipped debug-panics feature is on. The CLI has no catch_unwind or std::panic::set_hook: a tripped assert prints thread 'main' panicked at crates/mds-core/src/<file>:<line>:<col>: plus the message to stderr and exits 101.

Asymmetries: the assert's source location is disclosed only on the CLI; 101 is outside the documented exit-code table; mds watch dies instead of reporting and continuing.

Proposal: a hook in main.rs that prints mds: internal compiler error: <message> (message only, through sanitize_control_chars_wire) plus an issue-tracker pointer, keeps or documents exit 101, and catch_unwind around per-file compiles in watch. Not done in #220 because it changes CLI stderr contracts pinned by the cli_* suites.

Also: SECURITY.md (the "debug-panics" paragraph, ~line 83) says mds-core exposes debug-panics; only the three bindings do.

Refs #220, PR #388.

[dean0x]

moved to v0.5.0 in the v0.4.3 step-D triage: changes the CLI stderr contract and needs a catch_unwind design for the watch loop; a minor-release CHANGELOG entry, not a v0.4.3 patch.