perf(odf): halve what a spreadsheet costs to decode, and stop two repeat bombs

[andiwand]

🤖 Generated with Claude Code

Closes #768. Takes most of #762, and fixes a bug found on the way.

odr-private/ods/efficiency-big-1.ods (1.4 MB, a 297 MB content.xml) went from
1667 MB to 873 MB of peak footprint, and from 1.87 s to 1.22 s to decode.
Rendering the first view now adds nothing measurable on top.

Measured with phys_footprint — the metric jetsam and lmkd actually use — on
macOS arm64, streaming the html to a sink.

	now	before
inflated content.xml, which the dom points into	284 MB	284 MB
pugixml dom	116 MB	594 MB
sheet index	89 MB	274 MB
elements + side maps	285 MB	320 MB
peak through the first view	873 MB	1667 MB

The four commits

perf(xml): pugixml in compact mode. A xml_node_struct costs 12 bytes
instead of 64, an attribute 8 instead of 40. The engines keep the parsed dom
resident as their backing store, so this is the single largest line item, it
helps odf, ooxml, svg and the xml source view alike, and no src/ code changes.
The define is ABI affecting and a translation unit that misses it links fine and
then reads the tree through the wrong layout, so it rides on the imported target
and is paired with header_only=True — there must be no prebuilt library to
mismatch against. xml_util.cpp asserts the layout it compiled against.

conan.lock needs no change: it pins recipe revisions, and an option changes the
package id, not the revision.

fix(odf): a repeated sheet cell is one entry, not one per position. A sheet
already stored repeated columns, rows and empty cells once, at the end of the
range they repeat over. Cells with content were expanded — three elements per
position. Both repeat counts are unbounded and the grid is 1048576 x 1024, so:

flat ods	before	after
403 B, 1 x 1	0.0 MB	0.0 MB
406 B, 1 x 1000	0.4 MB	0.0 MB
407 B, 200 x 200	19.0 MB	0.0 MB
409 B, 1000 x 1000	527.3 MB	0.0 MB

A ref naming the whole grid asks for three billion elements from four hundred
bytes. Collapsing the group removes the expansion and with it the entire
empty-row special case, which existed only to avoid it — the two branches become
the same code.

perf(odf): sorted vectors for the sheet index, a deque for the elements.
Parsing appends in document order, so the index keys only grow and a tree buys
nothing over an upper bound — while a rb-tree node spends 64 bytes carrying 12,
and every row carried a map of its own. Cells now live in one array per sheet,
each row recording where its run starts: two allocations per sheet rather than
one per row. The elements move to a deque because create_element hands back a
reference and the parser keeps parsing under it, and because a vector reaches its
peak holding both halves of the doubling. table_rows/table_columns
materialised every row of a sheet on each of the three walks a render makes;
for_each_table_row visits them instead.

fix(ooxml): bound a merged range by the cells the sheet has. Sibling of the
odf bomb, found while measuring. <mergeCell ref="A1:XFD1048576"/> marked covered
cells by visiting all 17 billion positions, so a workbook of a few hundred bytes
never finished opening. Past the point where the range is wider than the sheet has
cells, walk the cells instead.

Verification

• odr_test green: 1256 pass, 6 pre-existing skips.
• The whole reference-output corpus is byte for byte identical, public and
  private — which is the point: every change here is representation, not meaning.
• New regression tests: a 1048576 x 1024 repeat is under 16 elements and still
  reads correctly at every position it covers; a whole-grid mergeCell opens in
  0 ms (it does not return within 8 s with the guard removed).
• The two mergeCell paths were shown equivalent by forcing the new one for
  every merge and re-running the corpus, ruski.xlsx's 111 merges included.
• cli, jni and odr_test all build; the debug and release conan profiles
  were regenerated.

Not in here

Left for #762, with measured numbers in the issue: the element registry still
builds a cell, a paragraph and a text for every non-empty cell before any
HtmlConfig limit applies, and the 284 MB source buffer goes only with a
streaming parse. The remaining ladder — side maps to sorted vectors, a narrower
stored id, an exact reserve — is worth about another 170 MB in the same file.