Harden parser contracts and release qualification

[Ismail-elkorchi]

Summary

• validate source-patch edit shapes and attribute names, normalize HTML attribute identity case-insensitively, and reject namespace-changing foreign-element spellings and conflicting edits
• validate fragment element and attribute local names at the shared name boundary
• simplify retained public trees while preserving optional namespace prefixes required for lossless serialization
• reduce parser accounting and allocation overhead, and enforce CPU-efficiency and retained-heap recovery against both immediate baselines and tagged v0.1.1
• expand the document browser differential from 26 focused cases to 1,698 applicable pinned WPT cases plus the focused probes
• replace arbitrary-ref publication with a release-only workflow that qualifies and revalidates the exact tag/current-main commit before publishing

Public contract changes

• ElementNode.tagName and Attribute.name are removed; qualified names are derived from namespaceUri, optional prefix, and localName
• uncaptured spanProvenance values are omitted instead of storing "none"
• OutlineEntry.tagName is renamed to localName
• malformed, unknown, sparse, inherited, conflicting, or namespace-changing unnamespaced patch edits now fail validation

Validation

• complete CI profile: 180 behavior/tooling tests, 89 strict-TypeScript engine tests, 6,998 tokenizer fixtures, 3,828 WPT tree cases, Node/Deno/Bun agreement, browser smoke, docs, architecture, and installed-package checks
• public qualification: 186 serialization cases and 392 fragment executions
• Playwright 1.61.1: Chromium 149, Firefox 151, and WebKit 26.5 pass 1,724 document, 156 serialization, and 14 fragment differential cases
• 600 deterministic fuzz runs; five exact resource-limit comparisons; 98/98 mutations killed; supply-chain checks green
• 12 isolated performance rounds pass unchanged thresholds; tagged-v0.1.1 medium/large parser ratios are 0.9023/1.1637 for CPU throughput and 0.9916/1.2648 for retained heap
• package, lockfile, and JSR manifests remain at 0.1.1