Follow up on transport, test setup, and documentation review

These findings came from the review of #239 and are intentionally deferred to a separate SubVerso cleanup.

• Fix netstring framing under short reads in src/SubVerso/Helper/Netstring.lean. The reader stops at the payload length although it also expects the terminator in that buffer. Reproduced: malformed 3:ab, is accepted as ab; valid 3:abc, is rejected when the read returns the three payload bytes before the comma. Read the payload and terminator separately, and cover empty payloads and truncated frames.
• Repair and activate Tests.testNetstrings. It is not called by the test driver's main, and its long-input loop doubles a string 100 times. Replace that case with bounded inputs and a stream that deliberately returns short reads before enabling the test. This is separate from the elaboration-time tests in InternalTests.lean, which already run during lake build.
• Update the nightly workflow's demo setup. It builds demo directly, but the demo's no-mod dependency is generated by the test driver under .builds. The obsolete setup step gates the test step. Use the existing preparation/test driver, and correct the demo lakefile's outdated comment about a Git dependency.
• Remove deleted source files when refreshing cached test projects. Tests.prepareProject overlays current files onto cached project/dependency trees; obsolete files can survive. Synchronize sources while preserving build artifacts, and verify that removing or renaming a module produces the same test inputs with and without restored caches.
• Correct the older README instructions. Module extraction produces an object with data and items, rather than a top-level array; helper startup requires arguments not shown in the current instructions.
• Investigate typed internal representations for reflow-format payloads and saved examples. Reflow data is currently JSON inside strings, and the example environment stores JSON. Establish the compatibility requirements first, then consider keeping typed values internally and serializing at transport/export boundaries.
• Consider a named result record for checkSignature. It returns highlighted output, diagnostics, source text, source positions, and info trees. This is optional API cleanup, deferred to keep #239 focused.

The framing failures above were confirmed with Lean probes. The representation changes are design investigations, not demonstrated correctness defects.

Start with the confirmed framing failures in src/SubVerso/Helper/Netstring.lean and the inactive Tests.testNetstrings, then inspect the nightly workflow, demo lakefile, Tests.prepareProject, README, and InternalTests. Treat the representation and checkSignature items as separate design investigations; the issue is done only when its selected cleanup areas have tests or verified setup and documentation updates.