S14.10: Custom-SD integrator guide + example/BDD

[DavidCozens]

Parent epic: #64

Context

The user-facing payoff of the foundation wave: document and demonstrate authoring a
custom SD element with the new safe API, and lock the escape behaviour with an
oracle round-trip BDD (the PARAM-VALUE escape-rules BDD originally deferred from
S07.04 #68).

What changes

• Flesh out docs/structured-data.md into a full integrator guide: implement
  Format(base, element), register the SD in Config.Sd[], custom SD-ID
  name@enterprise + enterprise-number registration guidance, value escaping +
  streaming, the JSON-in-value pattern, fail-loud name validation.
• Add a worked custom SD (BDD target and/or example) that emits a custom
  element including a value containing each of ", \, ] and/or a JSON blob.
• Oracle round-trip BDD: drive custom-SD values (and software/swVersion)
  containing each escapable char through syslog-ng and assert the decoded value
  round-trips byte-for-byte.

Acceptance criteria

• docs/structured-data.md is a complete custom-SD integrator guide.
• A worked custom-SD example exists and is built + tested.
• The oracle BDD asserts the escape round-trip for ", \, ] in a custom-SD
  value through the real syslog-ng oracle.

Out of scope

• Per-message SD attachment via SolidSyslogMessage (E14's later wave).

Areas affected

docs/structured-data.md, Bdd/ (feature + step definitions + a custom-SD target),
example wiring, Tests/Bdd/ if applicable.

[DavidCozens]

Scope note — escape round-trip oracle BDD dropped.

The acceptance criterion for a dedicated oracle BDD asserting that ", \, ] in a
custom-SD value round-trip byte-for-byte through syslog-ng was not implemented, by
design:

• PARAM-VALUE escaping is already locked at the SolidSyslogSdValue level by unit tests
  (the library applies RFC 5424 " / \ / ] escaping; those tests assert the exact
  on-wire bytes).
• syslog-ng and the OTEL collector re-render a parsed SD value differently (un-escape
  rules, quoting). An oracle assertion on the decoded value therefore tests the oracle's
  rendering, not the library's escaping — it would be brittle and prove the wrong thing.

The worked example was kept deliberately simple (detail="Hello World") rather than
muddied with escaped characters, and custom_sd.feature asserts the happy-path
round-trip through the real syslog-ng oracle (custom element reaches the receiver,
detail decodes to Hello World).

Delivered in #562.