Fix DOM AOT getElementById warnings and C14N after mutation

[PurHur]

Summary

• getElementById / id-map (Regression: AOT DOMDocument::getElementById null after replaceChild same id + setIdAttribute — Zend/VM null, AOT finds node (re-#25274, ext/dom/node.c) #29694): use peekStringKeyToValueBox (no undefined-index warning) for PROP_ELEMENT_ID_MAP reads in JitDomGetElementById and first-wins id-map seeding in JitDomLoadXMLUserScript.
• C14N after mutation (AOT: C14N/C14NFile compile-time fold ignores DOM mutations — appendChild/insertBefore/replaceChild/removeChild silent wrong output (ext/dom/node.c) #32972 / Regression: AOT DOMNode::C14N() returns null after appendChild/prepend/replaceChild — DomRegistry miss after #34666 markTreeMutated (re-#32972, ext/dom/node.c) #34862): refresh compile-time loadXML after LiveSlots appendChild — markup-based same-parent move (idempotent when sync runs twice), refresh from stamped inner when LiveSlots rebuild skips literal merge, and rebuild C14N fold source from compileTimeDomInnerXml when the document literal lags.

Verify

./script/aot-smoke.sh
# aot-smoke: 8 passed, 0 failed

./script/phpunit.sh --filter 'DomC14NAfterMutationAotTest|Issue29694DomGetElementByIdReplaceChildAotTest'
# OK (2 tests, 17 assertions)

Not covered

• Full compliance / differential sweep (DOM-only AOT unit repros above).
• SIGSEGV repros (maintainer_gap_dom_c14n_xpath, nodelist fresh-length) — separate follow-ups.

Closes #29694
Closes #32972

Made with Cursor