Summary

Float literals accepted digits '.' digits but rejected any input containing _, while integer literals accept 1_000.0-style separators. The asymmetry forces numeric groupings to be omitted in float sources and produces a confusing TYP019 for 1_000.5.

This PR mirrors the integer path: copy the source into a stack buffer, reject leading, trailing, and double underscores, then run the existing digit shape check and strtod on the stripped text. Behavior stays byte-equivalent for inputs without _.

Closes one item from #318 (audit finding B5, re-confirmed against main).

Test plan

conformance/native/pass/float-literal-underscores.0 covers 1_000.5, 0.0_5, 1.0e1_0, 1_000.0
conformance/native/fail/malformed-float-underscores.0 covers trailing underscore (still TYP019)
pnpm run conformance passes (all 600+ pass fixtures, all fail fixtures)
compiler-metrics.mts has 0 violations (budget bumped by 20)
No C compiler warnings