Linkage state machine + set_rust_owned for orphan ownership

[dginev]

Summary

Replaces the _Node.unlinked: bool field with a 3-variant Linkage enum
(Linked / Unlinked / RustOwned) that drives _Node::Drop. The old
"free if unlinked" heuristic conflated tree-detachment with Rust ownership
and could fire xmlFreeNode against memory the source document still
considered live — corrupting the dictionary on the next xmlCopyNode
against a sibling, with no last-error.

The new Drop rules:

• Linked — source document owns; never free.
• Unlinked — xmlUnlinkNode ran but node->doc is still set; free
  only if node->doc == NULL (true C-level orphan).
• RustOwned — caller transferred ownership via set_rust_owned;
  always free.

New API

• Node::set_rust_owned(&self) — transfer the C allocation's lifetime to
  the wrapper. After this, the last Node clone's Drop calls
  xmlFreeNode, regardless of node->doc. Sticky across clones.
• Node::is_rust_owned(&self) -> bool (also on RoNode, always false).
• Document::dup_node_into_new_doc(&Node) -> Result<Document, ()> — deep
  copy a subtree into a fresh, independent document. Works around
  xmlDocCopyNode returning NULL on the second call within one source
  doc.

Misuse-mode guards

• set_rust_owned debug-asserts on Linked input.
• set_linked (crate-internal, called from add_child / add_*_sibling)
  debug-asserts on RustOwned input to catch re-link-after-takeover.
• Document::import_node returns Err(()) on RustOwned source —
  release-mode guard since the set_linked debug-assert is compiled out.

debug_assert! is fully elided in release builds, so hot paths keep
their prior cost.

Test plan

• cargo test --tests — 98 tests across 11 files, all pass
• set_rust_owned happy paths: default state, idempotent, sticky
  across clones, post-dup_node_into_new_doc, drop-before-source-doc,
  mixed reattach, descendant-wrappers-drop-before-parent, 16-section
  stress
• Misuse #[should_panic] tests in debug builds
• import_node rejects RustOwned source (release-mode regression
  test)
• ASAN (-Z sanitizer=address): zero leaks across all rust_owned_*
  tests; the pre-existing node_can_unbind leak (379 B / 6 allocs) is
  preserved as the documented "unlinked-and-forgotten" baseline that
  set_rust_owned is the cure for

Note on documented constraints

Three lifetime constraints are documented but not enforced in release:

1. A RustOwned orphan must drop before its source document is freed
   (libxml2's xmlFreeNode walks node->doc->dict).
2. Don't call set_rust_owned on a Linked node.
3. Don't re-link a RustOwned node via add_child / add_*_sibling /
   import_node.

Each is debug-asserted; misuse in release is silent UB. This matches the
prior shape of the crate's safety contracts.

Motivation

The latexml-oxide post-processing pipeline implements --split by walking
the source document and, for each chapter or section, unlinking the
subtree, deep-copying it into a fresh sub-document, serializing it as a
standalone page, and discarding the source-side detached node. This
exercises every edge in the new state machine: the Unlinked → RustOwned
transition replaces the prior UAF (the second xmlCopyNode returned NULL
because the first wrapper drop had freed memory the source dict still
referenced), dup_node_into_new_doc is the per-page extraction primitive,
and set_rust_owned reclaims each extracted node so the per-document
allocation cost stays bounded across hundreds of split pages.