dash/scripts: the last two literal NUL bytes become escapes

[nyblnet]

Two tracked sources carried a literal NUL byte inside a sentinel string. grep
answers a query against such a file by saying nothing at all — not "no match",
just silence — because one control byte makes it treat the whole file as binary.

file	sentinel
dash/src/filter.ts:147	matchKey's "(Blanks)" key
scripts/test-clipboard.ts:314	the colour-agreement rig's fallback marker

Both are un-collidable prefixes — the same idea as the U+001F separator in the
CRDT elKey — so the intent was right and only the encoding was wrong. Written as
\u0000 they are the byte-identical string, which is already this repo's idiom
for \u001f in kernel/src/sync/crdt.ts and spaces/src/fields.ts.

-  if (isBlank(v)) return '<NUL>blank'
+  if (isBlank(v)) return '\u0000blank'

-  const FB = '<NUL>fallback'
+  const FB = '\u0000fallback'

filter.ts was hidden twice over

Git calls a diff binary when it finds a NUL in the first 8000 bytes, and that
one sat at 6911. So git grep answered Binary file HEAD:dash/src/filter.ts matches — no line, no content — and every diff of the file came back as Binary files differ, which reads as a generated blob nobody should be reading.
test-clipboard.ts's NUL was at 17979, past that window, so only grep lost it
and code review still worked. Both now grep and diff normally.

That is also why the filter.ts hunk shows as Bin 21884 -> 21889 bytes in this
PR's diffstat: the old blob is the binary side. Diffs from here on are text.

Verification

• grep -c "" gives 535 / 343 instead of silence; grep -n "blank" dash/src/filter.ts finds line 147 along with 20 other hits that were invisible.
• Zero NUL bytes in either file. A sweep of every tracked file now finds NULs only
  in genuine binaries (fonts, images, media, the gradle wrapper) — these were the
  last two in the repo.
• Values confirmed byte-identical by evaluating the literals as they stand in the
  source: both begin at codepoint 0.
• tsc -b clean in dash/; test-dash-filter 86/86; test-clipboard 73/73
  (bundled with esbuild exactly as CI does — it is not standalone, it imports six
  slides/src modules).

No behaviour change and no test moved.

Notes

Scoped to its own PR per docs/PARALLEL-WORK.md: dash/ is an app zone and
scripts/ is ops.

This class of bug is already documented in docs/DECISIONS.md — DECISIONS.md
itself carried one until a61b211, and the entry that repair points at says to
write these as an escape. This applies that to the two remaining instances.

Not done here, as it would touch a third zone: a CI gate rejecting a NUL byte in
any tracked text file would stop this recurring, rather than fixing instances
three and four.