Errors: render malformed template escape SyntaxErrors

Parent: #899

Problem

Nine direct bare exits in cookTemplateQuasi and validateTemplateEscape collapse malformed untagged template escapes to ParseError.UnexpectedToken. The parser has already identified both the escape family and its byte cursor, but discards both before the eval boundary.

Executed on current main (1ffe681), all 17 probes differ from raw JavaScriptCore 625.1.22:

• malformed \x forms (3 first-quasi forms plus one tail after a substitution): zig-js emits eval: UnexpectedToken at ...; JSC emits \x can only be followed by a hex character sequence
• malformed fixed and braced \u forms (10): zig-js emits the tag; JSC emits \u can only be followed by a Unicode character sequence
• \00, \8, and \9 (3): zig-js emits the tag; JSC emits The only valid numeric escape in strict mode is '\0'

Tagged templates must continue accepting these escape sequences with an undefined cooked value.

Implementation

• Return the exact diagnostic family and invalid-escape cursor from the existing validation pass.
• Attach the diagnostic at the offending backslash for first, middle, and tail quasis, including templates whose earlier CR/CRLF bytes were normalized.
• Match raw JavaScriptCore prose for the three families.
• Preserve tagged-template semantics and keep all diagnostic formatting on failure paths.
• Do not rescan the complete source or add a legacy fallback.

Verification

• Pin reason, message, and byte offset for all existing malformed cases plus a failing tail after a substitution.
• Pin valid tagged forms with undefined cooked values.
• Add a focused production eval case for all three messages.
• Compare exact-parent test/language/expressions/template-literal and test/language/expressions/tagged-template runs, reporting denominators and flips.

Implemented and pushed to main in 78d0d08.

• Malformed \x, \u, and numeric template escapes now retain their exact diagnostic family and backslash offset.
• First, middle, and tail quasis are covered, including offset remapping after CR/CRLF normalization.
• Tagged invalid escapes remain valid and produce undefined cooked entries for all three families.
• Valid templates do no new scan or allocation; source-offset remapping runs only on the rejected untagged path.

Validation:

• parser module: 233/233
• focused frontend boundary: 1/1
• raw JavaScriptCore differential: 17/17 byte-identical messages
• exact-parent test262 comparison: template-literal 57/57 and tagged-template 27/27 before and after (0 flips)

This reduces direct return ParseError.UnexpectedToken; sites from 81 to 73.