fix: two causes of run-to-run graph variation and three silent content losses - #2974

What does this PR do?

Five independent fixes, one commit each. Two remove causes of an index giving a different graph from one run to the
next; three stop content from being lost without a word. All five were found by scoring main against compiler-grade
references and by re-indexing the same checkouts repeatedly.

The fixes

Package map (src/pipeline/pass_pkgmap.c). cli/cli has its own go.mod and a test fixture's copy with the same
module path. cbm_pkgmap_build kept the first entry per name in worker order, so the fixture won whenever worker 0
happened to parse it, and the module root pointed into the fixture directory. Both outcomes reported
status: indexed. The candidates are now ordered by package name, depth below the repository root and path before
the first-wins insertion; the sequential builders go through the same function. With the fix, 100 of 100 runs on the
same checkout give the normal graph.

Jsonnet scanner (internal/cbm/vendored/grammars/jsonnet/scanner.c). tree-sitter restores a scanner's state
right before each scan and saves it right after; with shared variables, another thread's write in that window
changed the scan in flight. Its deserialize also ignored the zero-length call that starts a parse, so a file ending
inside an unterminated quote left that state to every later parse in the process. The state now lives in the
per-parser payload and is reset on every deserialize; lexing logic and the 3-byte serialized state are unchanged.
With the fix, the 68 files give one result in 30 of 30 runs with none partial, and the whole repository one result
in 5 of 5.

Graph buffer (src/graph_buffer/graph_buffer.c). The function compares the array length before and after the
push; on a failed push it frees the edge and returns 0 before any index sees it.

Non-UTF-8 source (src/foundation/json_writer.h, two call sites). cbm_json_write_text writes a valid document
exactly as before. Only a refused document is written again with the flag pair the layout writer already uses, so
each undecodable byte becomes an escaped U+FFFD. That flag pair comes from the fix for #2907 (ba22c965a); thanks to
@mvanhorn, whose approach this reuses for the pipeline. On a repository with only valid text (hugo), 2,178 surface
rows and 757 unresolved rows are byte-identical before and after.

C# using directives (internal/cbm/lsp/cs_lsp.c). The stack keeps 256 entries inline and doubles on the file's
arena when it is full. No new cap and no budget.

This PR changes a vendored grammar and the CI lint gate

• Local patch on vendored code. internal/cbm/vendored/grammars/MANIFEST.md records the jsonnet patch next to
  the properties scanner's (the same defect class), THIRD_PARTY.md notes it must be re-applied on re-vendor, and
  scripts/vendored-checksums.txt is repinned for the two changed files.
• New lint in lint-ci. lint-vendored-scanners (scripts/lint-vendored-scanners.py) rejects mutable
  file-scope state in grammars/*/scanner.c and the headers beside them (132 files). It reports exactly the three
  jsonnet variables on main's scanner and nothing on this tree. Four read-only cases in haskell and purescript are
  whitelisted with their reasons; a whitelist entry that no longer matches anything fails the gate.
• Test-only allocation fault. cbm_mem_test_fail_next_realloc is compiled only with CBM_MEM_TEST_API, which
  the test and TSan flag sets now define.

Tests

Every fix has a test that fails on main for the right reason, passes with the fix, and fails again with the
production change reverted:

The two variation tests need no threads and no timing: the package-map test hands the same manifests to the merge in
both worker orders, and the scanner test runs a second parser from inside the first parser's input callback.

Local, on the combined tree under ASan and UBSan: edge_imports, parse_coverage, graph_buffer, mem,
dyn_array, mem_events, str_util, pipeline_semantic_manifest_repro, cs_lsp and grammar_regression, 584
passed, 0 failed, no sanitizer report; the pipeline and doc_mentions suites passed on the UTF-8 fix alone (740
passed with str_util and pipeline_semantic_manifest_repro). clang-format and cppcheck on the changed
production files, the memory-core, NOLINT and vendored-scanner lints, and the vendored checksum comparison (1,096
entries). The full local ladder was not run.

Not in this PR

Related defects found while doing this are recorded for follow-up, among them: cbm_gbuf_upsert_node and the merge
path ignore a failed growth the same way; Go interface methods and TypeScript keyof members are cut at 63; and
the graph also differs between one worker and many, which makes it depend on the machine's core count.

Checklist

• Every commit is signed off (git commit -s)
• Tests pass locally (make -f Makefile.cbm test): only the affected suites were run locally, PR CI runs the rest
• Lint passes on the changed files, including the new lint
• New behavior is covered by a test (reproduce-first for bug fixes)