fix: contain parser panics and stack overflows, and decide from the CST

[shahryarjb]

Hardening pass over the Rust side, plus a dependency audit. Nothing here changes the public API; the headline is that two ways of taking the BEAM down were found and closed, both of them in input handling rather than in the codemods themselves.

• A parser panic can no longer escape. biome_css_parser 0.5.8 asserts that it keeps making progress and panics on some input — the property tests found one, which shrinks to @layer/*x*/\n color: var(--brand);\n}\n. Rustler turns that into an exception in the calling process, which the VM survives but which breaks the promise that unpatchable input returns {:error, reason}. Every parse now goes through ParseCtx::try_new, which catches it and reports it as Unparseable. Pinned as a deterministic test, including one that asserts the input still panics the raw parser — so if Biome fixes it upstream, that test fails and says the guard may be removable.
• Deeply nested input is refused rather than overflowing the stack. A stack overflow aborts; catch_unwind cannot intercept it, so in a NIF it ends the VM rather than the call. Measured on a 2 MB stack, both @media{ nesting and :not( nesting survive 1000 levels and abort at 2000. Every entry point now measures nesting first — a byte scan that skips strings and comments and cannot itself recurse — and refuses past 256. Real CSS measures depth 7, including a 60 KB ex_doc stylesheet. The same limit applies to caller-supplied text, which turned up a second problem: a selector past the limit did not crash, but ensure_rule would splice it in and produce a file we would then refuse to read.
• Native CSS nesting is now visible to queries that descend. Biome models &:hover { } as CSS_NESTED_QUALIFIED_RULE with a CSS_RELATIVE_SELECTOR_LIST, not CSS_QUALIFIED_RULE, so find_all_rules skipped nested rules entirely and analyze reported one rule for a file containing three. Top-level queries are unchanged — nesting stays scoped.
• analyze is no longer quadratic in nesting depth. conditions_of rebuilt the list of every at-rule in the file once per ancestor, for a node it already held, and prelude_norm scanned a whole subtree when it needed only the tokens before the block. Depth 128 went from 20.6 ms to 1.9 ms, and growth is roughly linear.
• Decisions come from the CST, not from scanning text. Selector normalisation was a character scanner tracking quote state and bracket depth; it now walks the tree, which also fixed a real bug — :nth-child(2n + 1) and :nth-child(2n+1) are one selector, and the scanner kept them distinct. Colour detection matched 148 names against raw text and needed a hack so url(/red.png) was not read as red; it now matches CSS_COLOR, CSS_FUNCTION and CSS_IDENTIFIER node kinds, and the hack is gone. At-rule preludes and caller-supplied declaration lists are likewise token-derived now.
• No panicking paths remain outside tests — no unwrap, expect, panic!, todo!, unreachable!, or unchecked indexing reachable from a NIF.
• Dependencies. ex_doc and igniter declared floors that sat well behind what the lock resolved (~> 0.38 against 0.40.3, ~> 0.5 against 0.8.3); mix hex.outdated does not catch this, because it compares resolved versions rather than requirements. Everything else, Elixir and Rust, is already at its newest published version. Cargo.toml now records why the biome pin is 0.5.8 and what would break it: biome_css_formatter is stuck at 0.5.7 and requires biome_css_syntax ^0.5.7, so depending on it would drag the whole graph back a release — which is exactly why igniter_js pins its set to 0.5.7.
• Docs. Sixteen comments cited a ROADMAP §… that is not in this repository, and others carried its rule letters, risk IDs and constraint numbers; all are now self-contained or link to the module that holds the behaviour. Migration commentary about the previous implementation is gone from the code — the changelog is the right place for it.
• Two agent skills under .claude/skills: the release flow, and the codemod conventions with the failure modes behind them.

Verified on Elixir 1.20.2 / OTP 28.0.2: 355 Rust tests, 307 Elixir, clippy -D warnings clean, credo, sobelow, dialyzer and both formatters clean, and no warnings from this project. Target coverage was checked against rustler_precompiled's defaults — we build nine of its ten plus FreeBSD; the missing one is 32-bit ARM, which ash-ci disables for all rustler projects because of a cranelift bug.