Gate the compatibility normalizer on a streaming scan instead of a full parse

[JSv4]

Closes #619.

The gate that never closed

MarkupCompatibilityNormalizer.Normalize decided whether a part needed either of its two repairs by building the part's whole XDocument and sweeping it twice. What was supposed to keep that rare was a literal substring test:

if (!text.Contains("AlternateContent", StringComparison.Ordinal) &&
    !text.Contains("pPr", StringComparison.Ordinal))
    continue;

Every real word/document.xml contains pPr, so the gate never closed. PreAccept runs the normalizer once per side of every comparison, so that was a DOM build plus two descendant sweeps per side — and the pPr half exists for a repair that fires on paragraphs carrying two or more direct w:pPr, a malformed shape the reference document has zero of. The cost was almost entirely the cost of proving there was nothing to do.

What replaces it

A streaming XmlReader pass that answers the same two questions without building a tree: is there an mc:AlternateContent anywhere, and is there a paragraph with two or more direct pPr children. It tracks the open-element stack per depth, so a duplicate separated by a nested subtree (the shape a comparer produces when it inserts revision runs between the two malformed property elements) still pairs, and one pPr per sibling paragraph is never mistaken for a duplicate.

Two smaller things fall out of restructuring it as detect-then-rewrite:

• The detection pass opens the archive read-only, so a package needing no repair never pays ZipArchiveMode.Update's entry buffering. That was option 3 in the issue; it comes free here rather than as a separate change.
• The detection pass reads each entry as a stream rather than materialising it as a string, so a 574 KB document.xml is no longer decoded to a string just to be substring-searched.

Only a package with a candidate part reaches the rewrite pass, and only its candidate parts are parsed.

The gate is still a superset

The issue's constraint is the one that matters: a part that needs repair and is skipped is a correctness bug, where an over-broad gate is only a performance one. The scan matches on local names, while both repairs are namespace-exact (doc.Descendants(W.p), paragraph.Elements(W.pPr)). So the gate admits strictly more than the repairs act on — a false positive costs one parse of one part and still returns it unchanged, and a false negative cannot happen. That also preserves the property the old literal had and its comment cared about: a part binding the WordprocessingML namespace to a prefix other than w is still found.

Malformed XML answers "no", which is what NormalizePart already concluded by returning null on XmlException.

Measured

benchmarks/docxdiff-stress --probe against TestFiles/NVCA-Model-COI.docx (574 KB of document.xml, 15,360 elements), median of five:

	before	after
MarkupCompatibilityNormalizer.Normalize ×2	31.6 ms	10.2 ms
StrictOoxmlNormalizer.NormalizeToTransitional ×2	7.8 ms	7.9 ms

About 21 ms off every comparison, or roughly 6% of a ~350 ms Compare.

Output parity

The full corpus differential, which is the check this change actually needs — --probe alone would not catch a gate that wrongly closed:

$ dotnet run -c Release --project benchmarks/docxdiff-stress -- --corpus TestFiles --check main.json
[parity] OK - all 14,916 digests identical across 678 documents

That covers the redline package, revision list, edit script, all four consolidate products and the compatibility report, across eight generated edit shapes, for every .docx/.docm/.dotx in TestFiles/ — including the ones that do carry mc:AlternateContent.

Tests

Five new tests, all specifically about the gate rather than the repairs, and the issue is explicit that this is what was missing (the reference document exercises only the skip path):

• Gate_FindsDuplicateParagraphPropertiesSeparatedByNestedContent — a whole w:ins subtree between the two duplicates.
• Gate_FindsDuplicateParagraphPropertiesInsideANestedParagraph — the duplicate is in a text-box paragraph nested inside a well-formed outer paragraph.
• Gate_DoesNotMistakeOnePPrPerSiblingParagraphForADuplicate — three sibling paragraphs, three pPr, no duplicate; counting per part rather than per paragraph would read that as a candidate.
• Gate_ResolvesAlternateContentInAPartOtherThanTheMainDocument — every .xml entry is a candidate, not just word/document.xml.
• Gate_FindsDuplicatesUnderANonstandardNamespacePrefix — the superset property the old literal had.

Verified non-vacuous: disabling the pPr half of the detector fails three of the five plus the pre-existing DisjointDuplicateParagraphProperties_AreCoalescedAndOrdered.

Full suite: 4180 passed, 0 failed, 3 skipped. No new files, so both warning baselines are unmoved.