fix(report): harden generic diagnostics title trust boundary

[seonghobae]

Defect

Protected main's public render_diagnostics_report() resolves title with title or _default_title(...) and later passes the value to html.escape(). A caller-controlled str subclass can therefore execute overridden __bool__ during title resolution or overridden replace() during HTML escaping.

Required contract

• Admit only None or an exact built-in str at the generic diagnostics report boundary.
• Reject caller-defined str subclasses with a package-owned ValueError before any caller callback can execute.
• Preserve the existing behavior that None and an empty exact built-in string select the report-type default title.
• Preserve HTML escaping for admitted exact built-in strings.
• Add a realistic public regression proving zero __bool__/replace callback dispatch and no output artifact on rejection.

Single-writer scope

python/fast_mlsirm/report.py is currently owned by #978. Implement this as a direct child of #978's exact head rather than opening a competing main-based writer. The child may touch only the title admission boundary, a focused test, and a governed changelog fragment. No statistical or psychometric arithmetic changes.