fix: unbreak release format check + clearer verify --verbose output

[robdmoore]

Summary

The 1.1.0 release failed CI on the format check, and verifyx all --verbose output was hard to scan. This fixes the release breakage and improves the failure/table output.

The release failure

The format check failed in CI on CHANGELOG.md. release-please generates the changelog in a markdown style oxfmt rewrites. It couldn't be reproduced locally because verifyx all runs oxfmt in fix mode locally — which silently reformatted CHANGELOG.md (leaving it dirty in the working tree) rather than failing. CI runs oxfmt --check ., can't rewrite, and exits 1. Committing the reformatted file wouldn't help either: release-please regenerates it unformatted next release.

Fix: ignore CHANGELOG.md in .oxfmtrc.json so neither check nor fix mode touches it.

Output readability

• Failing checks stand out. Under --verbose every check prints, so a lone failure was buried mid-list. Each failing check's output is now re-printed in red under a ▶ <name> (failed) heading at the end of the run, just before the summary.
• duplicate-code table no longer looks like a failure. jscpd hardcodes red header cells in its stats table (even on a clean 0-clones run) and ignores NO_COLOR/FORCE_COLOR. A new transformOutput hook on external checks strips jscpd's red so the table renders in the default colour.

Notes

The local fix-mode auto-rewriting of release-please's CHANGELOG.md is a silent footgun that any consumer project pairing this format check with release-please would hit. This PR closes it here; worth considering whether verifyx init should seed the same ignore for consumers.

Test plan

• npm run verify — all 11 checks + 113 tests pass
• Verified duplicate-code table headings render without red under verifyx all --verbose
• Forced a format failure in --check mode and confirmed failing checks re-print in red at the end
• Added src/shared/color.test.ts covering paintRed / withoutRed