v0.28.0 — containment closure and measurement honesty

Containment closure and measurement-honesty release.

Highlights

• Memory-budget path uniformity is complete. The parse loop, the Go compat-normalization walk, and the JS/TS fused compat walk all poll the same runtime memory budget and surface the same stop reason. A bare Parse of the Poppler witness (3.4 MB ambiguous JavaScript) — a path that previously escaped budget accounting entirely — now stops bounded at ~1.78 GiB peak RSS under the default 512 MiB budget with a graceful full-span error tree, and completes clean under a 2 GiB budget.
• Error recovery is ~18% faster on recovery-heavy workloads. The C-recovery per-subtree memo is now a fixed-capacity 2-way set-associative cache; every recovery decision is unchanged, clean parses are unaffected (measured neutral on the canonical workload), and a synthetic KDL garbage-suffix benchmark improves 83.2ms → 68.2ms (p=0.002).
• The perf ledger learns honesty about error-dense corpora. parse_gap_report/parse_gap_correlate now classify every corpus file clean vs error-bearing and report split ratios (clean_ratio, error_ratio, error_file_share) alongside the combined number, so tail-language ratchet rows stop conflating clean-parse throughput with recovery throughput.
• Pointer-light measurement rig. Benchmarks and an SoA prototype that measure bytes-per-node, GC scan cost, and walk throughput for the current node layout against a contiguous index-based layout — the standing gate instruments for the frozen-tree store investigation.

Full details in CHANGELOG.md.