Test that several dictionary corrections keep word confidences, and that malformed correction ranges fall back to plain text

## What happens

`Sources/UttrflowPipeline/DictationPipeline.swift:807-832`, `Transcription.saying(_ corrected: CorrectedTranscript)`, lays each dictionary correction over the heard words so the untouched words keep their recogniser confidence. Under test it has only ever seen zero or one correction:

- the sort closure on line 814 has never run, so no test has two corrections;
- the fallback when a range overlaps the previous one or runs past the words (line 818) has never run;
- the fallback when the rebuilt words don't spell the corrected text (line 832) has never run.

Measured on origin/main `26d7bc1` with `swift test --enable-code-coverage` (5,384 tests, all passing) and `xcrun llvm-cov export` over the test binary. The regions named below have an execution count of 0: no test runs them, so a change that breaks them passes `make verify`.

## Why it matters

The confidences decide which words the tidier may treat as doubtful. If two corrections in one dictation are laid down out of order, or a bad range is not caught, confidences land on the wrong words. The model could then "fix" a word the dictionary already settled, such as a person's or product's spelling the user added on purpose.

## How to reproduce

Run `swift test --enable-code-coverage`, then `xcrun llvm-cov show -instr-profile .build/debug/codecov/default.profdata .build/debug/UttrflowPackageTests.xctest/Contents/MacOS/UttrflowPackageTests Sources/UttrflowPipeline/DictationPipeline.swift` and look for the `0` counts on the lines named above.

## Acceptance criteria

- `saying(_:)` is `fileprivate`. Make it `internal` (a one-word change, reachable through `@testable import`), or drive it through the pipeline with a dictionary that corrects two words.
- A test with two corrections given in reverse order expects both corrected words at confidence 1, and every other word at the confidence it was heard with.
- A test with overlapping ranges, and one with a range past the end, expects the result to equal `saying(corrected.text)` (the plain-text fallback).
- Each new test fails when the branch it covers is broken. Check this by hand before opening the PR: temporarily change the branch (flip the condition or return the other value), see the test fail, then restore it.

## Where to start

- `Tests/UttrflowPipelineTests/ScoredWordsTests.swift` (suite "What the recogniser was sure of") builds transcriptions with word confidences.
- `CorrectedTranscript` and its `corrections` are in `UttrflowDictionary`. `Tests/UttrflowPipelineTests/DictationChangesTests.swift` already constructs them.

Read `CONTRIBUTING.md` first. Iterate with `swift test --filter `, then run `make verify` before pushing. Only tests change; no product code needs to.

**Size:** M.

Read CONTRIBUTING.md, then inspect Transcription.saying(_:) in Sources/UttrflowPipeline/DictationPipeline.swift:807-832 and the test setup in Tests/UttrflowPipelineTests/ScoredWordsTests.swift and DictationChangesTests.swift. Run a filtered Swift test while adding cases for reversed corrections, overlapping ranges, and an out-of-bounds range. Done means the confidence-preservation and plain-text fallback cases pass, each test fails when its covered branch is temporarily altered, and make verify succeeds.

Written by the indexing model from the issue text.