fix(runtime): detach StringBuilder buffer on build to prevent use-after-free

bux_sb_build returned sb->buf and then bux_sb_free freed it,
causing dangling pointers in all callers of StringBuilder_Build
followed by StringBuilder_Free (e.g. JsonParser_ParseString, Fmt).

Fix: bux_sb_build now detaches the buffer (sets sb->buf = NULL)
before returning it, so bux_sb_free only frees the sb struct.
This transfers buffer ownership to the caller.

rt/runtime.c

@@ -351,12 +351,14 @@ void bux_sb_append_char(BuxStringBuilder* sb, char c) {
 
 const char* bux_sb_build(BuxStringBuilder* sb) {
     if (!sb) return "";
-    return sb->buf;
+    const char* buf = sb->buf;
+    sb->buf = NULL;  // detach — ownership transferred to caller
+    return buf;
 }
 
 void bux_sb_free(BuxStringBuilder* sb) {
     if (!sb) return;
-    bux_free(sb->buf);
+    bux_free(sb->buf);  // safe: NULL if bux_sb_build already detached
     bux_free(sb);
 }