fix: parser & graph-walk DoS/overflow hardening (SEC-1, SEC-2, MEM-1)

[delta9000]

Parser & graph-walk DoS/overflow hardening

Closes #11
Closes #12
Closes #13

Three reproduced security/robustness findings from the scoped engineering review,
fixed together because they share one theme — bounding recursion/size over
attacker-controlled input — and one shared mechanism (runtime/RecursionLimits.hpp).

SEC-1 (#11) — parser deep-nesting stack overflow (DoS)

A few-thousand-deep document SIGSEGV'd in the recursive-descent readers
(XmlLite parseElement↔parseContent, JsonLite parseValue↔parseArray/
parseObject, ClassicVRML/VRML97 parseNode↔parseNodeBody). Added one shared
cap (x3d::kMaxNestingDepth = 1000) and an RAII DepthGuard in each reader that
throws std::runtime_error past the cap — joining each reader's existing
soft-failure path. The guard restores depth on return, so wide-but-shallow
documents are unaffected; legitimate scenes nest well under 100 levels.

SEC-2 (#12) — SFImage signed-overflow + ~2GB allocation

<PixelTexture image="1 1 2000000000 0xFF"/> drove packed >> (8*b) with an
attacker-controlled count (signed-int overflow, UB) and pushed numComponents
bytes/pixel (multi-GB OOM from one token). parseImageFrom now clamps
numComponents to the X3D §5.3.6 range [0,4] before the unpack loop and shifts
in unsigned. Width/height each consume one pixel token, so the pixel loop is
already bounded by the token stream.

MEM-1 (#13) — extractor/pick walks lacked the cycle+depth guard

BoundsSystem/TransformSystem already break a containment cycle, but the
extractor-side walks (SceneExtractor::walk, LightSystem::collect) and pick
walks (PickSystem::pickNode/worldOfRec) carried neither guard, so a USE-cyclic
or pathologically deep scene driven through these public APIs without
buildSceneGraph's up-front breakContainmentCycles() SIGSEGV'd. walk/
pickNode carry the live root→node PathKey and gain a hard depth cap plus a
path-membership test before descending; worldOfRec/LightSystem::walk (no path
accumulator) gain a depth cap. The normal pipeline still severs cycles at build
time — this makes the walkers self-safe when an embedder drives them directly
(mirrors BoundsSystem's existing computing_ defense-in-depth; see ADR-0016).

Definition of Done

• TDD: each fix has a regression test whose RED state is the real failure
  (SIGSEGV / 2GB alloc) and whose GREEN state is the bounded/throwing behavior.
• mise run ci green — build 45/45 ctests, golden byte-identical,
  conformance-gate OK, coverage-gate OK, doc-ctest-gate OK, cli-gate-regression
  PASS (Tier-1 200/200, no regressions; 1 previously-failing corpus item now
  passes).
• Per-header self-containment verified for the new + touched headers.
• Living docs updated in the same diff (anti-drift): parse-readers.md
  input-hardening note + new tests; ADR-0016 follow-up on the self-guarding
  walkers.
• No new third-party dependency → NOTICE unchanged.

Code review

A fresh-context adversarial review traced every recursion path and confirmed each
reader funnels through one guarded function (VRML97 dialect included, brace-skippers
are iterative), SEC-2's loop is genuinely token-bounded with a now-safe shift, and
MEM-1's path-membership cut preserves legitimate USE/DAG sharing with balanced
push/pop. Verdict: ready to merge. Two Minor follow-ups were applied in the last
commit: a counter-leak on the throwing guard (a reused reader could accumulate +1
per rejected parse) is fixed by checking before incrementing, and the three copied
guards are hoisted into one shared x3d::NestingGuard.

Known follow-up (out of scope)

The guards make the walkers crash-proof, not DoS-proof against a legitimate
acyclic "doubling DAG" (G0→[G1,G1], … ~30 deep): no back-edge, under the depth
cap, yet 2³⁰ distinct paths → exponential per-path emission. That is a separate
CPU/memory-DoS class (per-path emission is intentional for USE-instancing) needing a
different mechanism (emission budget / memoization), not the cycle+depth guard.
Recommend tracking as its own card — not filed here.

New tests

• runtime/codecs/tests/xml_depth_guard_test.cpp — XML deep-nesting cap (SEC-1)
• runtime/codecs/tests/sfimage_overflow_test.cpp — SFImage clamp (SEC-2)
• runtime/parse/tests/parser_depth_guard_test.cpp — JSON + ClassicVRML caps (SEC-1)
• runtime/scene/tests/walker_cycle_guard_test.cpp — extractor/pick/worldOf cycle termination (MEM-1)