v0.8.5

v0.8.5 — security fixes and the npm loader repair

Two findings from a security review done for a downstream third-party
import, both confirmed on the released 0.8.4 binary before anything was
changed, plus a broken npm release found on the way.

- Unbounded recursive descent. Every language plugin walked its syntax
  tree recursively with nothing bounding the depth, and the rayon worker
  stack was the 2 MiB default. Input as ordinary as a 3,000-term
  `a + b + c` expression, a fluent call chain, an if/else-if ladder or a
  deep literal overflowed it. A stack overflow is not a panic, so the
  catch_unwind in the C ABI and the Python and Node modules could not
  turn it into an error — the process died, and took any embedding host
  with it. Reproduced in 18 languages plus the JSON/YAML descriptors.
  analyze now runs on a 128 MiB host thread with matching pool workers,
  extraction is gated on the iterative cgg_lang::exceeds_depth against
  MAX_TREE_DEPTH (4,000 levels; deeper is skipped as `too-deep` and
  counted), and the -n 0 path DFS caps at 100,000. Affected every
  release through 0.8.4.

- `--since` executed code from the analyzed repository. It shells out to
  git inside the tree being analyzed, and git runs what that tree's
  config names: a core.fsmonitor command and a diff.<driver>.command
  routed by .gitattributes both executed on a plain `git diff`, verified
  on 0.8.4. The revspec was also passed bare, so `--since=--output=PATH`
  made git write that file. Git is now invoked with
  `-c core.fsmonitor=false --no-ext-diff --no-textconv` and
  `--end-of-options` before the revspec. Affected every release with
  --since.

- The 0.8.4 npm root package could not be loaded. index.js is generated
  by napi build and hardcodes the platform-package version it accepts;
  it was last regenerated at 0.8.3, so the published 0.8.4 tarball
  demanded 0.8.3 bindings in 27 places while its platform packages
  shipped 0.8.4. index.js and index.d.ts are regenerated here, and
  docs-check check 13 now fails any commit where the embedded version
  and package.json disagree. npm only; the CLI, crates, wheel and C ABI
  were unaffected.

Default graph unchanged. Memory safety verified clean under ASAN
(44 grammars, 315 malformed inputs, 145 corpus repos) and Valgrind.