remote-derive: avoid lifetime parameter collisions

[fallintoplace]

What

• Avoid lifetime name collisions in generated serde and arbitrary impls.

Why

• Newtypes using those lifetime names failed to compile.

Implementation

• Choose an unused name from the newtype generics, bounds, and wrapped type.
• Add coverage for declared and higher-ranked lifetimes.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[iainmcgin]

[claude code] Thank you for the PR. We are closing this one and keeping the reservation.

The __buffa and __Buffa prefixes are documented as reserved for the derive output (the "Reserved identifiers" section of the buffa-remote-derive crate docs), so a user lifetime named __buffa_de is outside what the derives support. This PR makes two of the generated names collision-proof (the __buffa_de and __buffa_arb lifetimes). The __buffa_iter lifetime and the generated type parameters (__BuffaIter, __BuffaSerializer, __BuffaDeserializer, __BuffaValue, __BuffaError, __BuffaVisitor) would still collide, and the docs section would then forbid something that partly works. The defect a user can hit without touching the reserved prefix, the unprefixed value bindings from #652, is fixed by #693.

The token scan itself is sound. Lifting the reservation entirely would mean covering every generated lifetime and type parameter plus the docs section; if you want to pursue that, please open an issue first so we can settle whether the reservation should go.