🐛 fix(dom, xslt): lock subtree copies

[gaborbernat]

th_tree_copy_node read mutable source nodes without holding their tree handles. Concurrent attribute writes could pair a copied pointer with a length from another source state; the 3.14t reproducer returned one L where only s or 4,096 L characters were valid.

Acquire source and destination handles with the ordered two-object critical section during adoption. Standalone DOM copies and stylesheet merges lock their source handles, while XSLT execution locks both the source and stylesheet. The copy remains a single arena pass; GIL builds preprocess the new handle expressions away.

[codspeed-hq]

Merging this PR will not alter performance

✅ 93 untouched benchmarks
⏩ 18 skipped benchmarks¹

---

_{Comparing gaborbernat:fix/cross-tree-copy-lock (ab4801b) with main (6809125)}

Footnotes

1. 18 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩