mur loc extract treats Segoe Fluent icon glyphs as translatable strings

## Summary

`mur loc extract` treats Segoe Fluent icon glyphs as user-visible text and extracts them into `.resw`. With `--rewrite` they are routed through `t.Message(...)`, making a decorative icon depend on a resource lookup — and making it eligible for AI translation.

## Repro

`samples/TodoApp/Program.cs` uses Private Use Area glyphs from the Segoe Fluent icon font as button/label content:

```csharp
Button("\uE74D", () => structural(new DeleteItem(item.Id))) // trash can
.FontFamily((FontFamily)Application.Current.Resources["SymbolThemeFontFamily"])

TextBlock("\uE73A") // decorative checkbox
```

```
mur loc extract --source samples/TodoApp --output --rewrite
```

Produces:

```xml


```

Verified code points (they are not empty strings — they render as blanks in most terminals):

```
Text len=1 U+E74D
Text2 len=1 U+E73A
```

And rewrites the source to:

```csharp
Button(t.Message(Loc.TodoApp.Text), ...)
TextBlock(t.Message(Loc.TodoApp.Text2))
```

## Why this is wrong

1. **A PUA glyph is not linguistic content.** There is nothing to translate. `mur loc translate` would hand `U+E74D` to an LLM and ask for a French version.
2. **It's a translation-corruption risk.** A machine or human translation pass over a `.resw` containing a lone PUA character can easily mangle or drop it, silently breaking the icon.
3. **It converts a constant into a lookup.** After `--rewrite` the glyph resolves through `IStringResourceProvider`; a missing key in some locale degrades or breaks the icon rather than falling back to a glyph that never should have varied.
4. **Spec 005 §10.3 says it shouldn't happen.** The extractor is documented to ignore "strings that are clearly not user-visible."
5. **The generated keys are meaningless.** `Text` / `Text2` carry no information about what the glyph is.

## Suggested fix

Skip string literals that consist wholly of Private Use Area code points (U+E000–U+F8FF, plus the supplementary PUA planes) — optionally only when the call site also sets a symbol font, though the PUA test alone should be safe and is much simpler.

A stronger version of the same idea: skip any literal containing no letter or digit in any script, which also covers punctuation-only and separator strings.

## Notes

Not a systematic false-positive: the `samples/ReactorGallery` run produced 561 keys with **0** empty or glyph-only values. This is specific to the icon-glyph idiom, which the Gallery happens not to use in extractable positions — but the idiom is common in real WinUI apps and is used in the repo's own sample.

Reproduced with `mur` built from `88ef6db4`.

Start with the `mur loc extract` entry point and reproduce the issue against `samples/TodoApp/Program.cs` using `--rewrite`; compare the behavior with Spec 005 §10.3. Trace the extractor’s handling of string literals and consider the stated PUA-only criterion; done means the icon glyphs are neither extracted into `.resw` nor rewritten through `t.Message(...)`.

Written by the indexing model from the issue text.