harden the edges the reviews found, and stop lending Kyiv Pittsburgh's saints

The years this calendar answers for are now 1 to 9999 and enforced at every
constructor. Arithmetic saturates instead of wrapping, which in a release
build had put a date in antiquity and produced an ISO string that was not ten
characters long; a seven-day walk stops at the boundary rather than running
past it.

--days took any integer and aborted the process trying to allocate for it, as
did --indent. Both are bounded now.

--update-menaion parsed a day out of a fetched page with no bound on it and
wrote keys like 01-4294967295 that no lookup could ever match, then wrote the
file even when the parse had failed, in replace mode, which would have blanked
a year of commemorations in a calendar that had been working. It bounds the
day by the month and refuses to write when most of the year comes back empty.

today() shelled out to date(1) and fell back to UTC without a word when it was
absent, so a container reported the wrong day either side of midnight. It says
so now.

The UGCC loaded the Ruthenian menaion. That is the Metropolia of Pittsburgh's
calendar of saints, and lending it to Kyiv is the same error as lending the
law, in a release whose headline is that a church's law is never borrowed.

Also: has_obligation was dead API about to be frozen, and two ptr::eq
comparisons stood in for asking whether the discipline was overridden, which
is what they meant.

CHANGELOG.md

@@ -39,6 +39,25 @@ Everything below changes what a day reports against pre-1.0 versions.
   no longer report any day as binding. They had borrowed Ruthenian particular
   law, which is not their law.
 
+### Hardened
+
+- The years this calendar answers for are 1 to 9999, enforced. `Date::from_ymd`
+  and `from_jdn` reject anything outside them, arithmetic saturates rather than
+  wrapping, and a seven-day walk stops at the boundary instead of running past
+  it into dates whose ISO form was not ten characters long.
+- `--days` is bounded at a hundred years and `--indent` at sixteen. Both took
+  any integer and aborted the process on allocation.
+- `--update-menaion` bounds the day it parses by the month it is in, and
+  refuses to write when most of the year comes back empty. The page is fetched,
+  so its contents are not this program's to trust: an unbounded parse wrote
+  keys no lookup could match, and a page redesign would have blanked a year of
+  commemorations in a calendar that had been working.
+- `today()` says on stderr when it cannot read the local offset, rather than
+  silently reporting UTC and so the wrong day either side of midnight.
+- The Ukrainian Greek Catholic Church no longer loads the Ruthenian calendar of
+  saints. It is Pittsburgh's, and lending it was the same error as lending the
+  law.
+
 ### Interfaces
 
 - `binds` is null unless the day binds, rather than the string `"none"`. Most