Fixes #977.

NamespaceResolver::push incremented its u16 nesting_level with an unguarded += 1. A document nested past u16::MAX overflowed it — a panic under overflow-checks builds, or a silent wrap that corrupts namespace-scope truncation in a stock release build (bindings from closed scopes leak; in-scope bindings vanish). The sibling pop already saturates (saturating_sub); only the increment was unguarded. Reachable from the public NsReader::read_resolved_event* on ~490 KB of deeply nested XML. Still present on master; orthogonal to #970/#972 (which capped declarations per element — this is the depth counter).

Fix

Return a new NamespaceError::TooDeeplyNested at the u16 boundary, matching the existing per-element TooManyDeclarations guard:

self.nesting_level = self.nesting_level
    .checked_add(1)
    .ok_or(NamespaceError::TooDeeplyNested(u16::MAX as usize))?;

A saturating_add (mirroring pop) was considered but is insufficient — it removes the panic but not the scope corruption: at saturation all deep levels collapse to u16::MAX and set_level's rposition(|n| n.level <= level) truncation still over-truncates, so the namespace misresolution persists (verified). The clean error rejects the pathological document instead.

Validation

• cargo test and cargo test --features serialize: all green (incl. the existing push_rejects_too_many_declarations).
• Added push_rejects_pathological_nesting_depth next to the NamespaceResolver::push — unbounded per-xmlns heap allocation inside NsReader, before the event is returned → OOM on untrusted XML #970 test — u16::MAX successful pushes, then a clean Err(TooDeeplyNested).
• The 490 KB PoC from Unbounded u16 depth counter in NamespaceResolver::push → panic / namespace-scope corruption on deeply nested XML #977 now returns Err(TooDeeplyNested) instead of panicking, and the namespace-misresolution demonstration no longer occurs.

Alternative considered: widen nesting_level to u32/usize (overflow becomes practically unreachable). I chose the explicit cap + error to mirror max_declarations_per_element and keep the depth bound intentional on untrusted input — happy to switch if you'd prefer no new variant.

Found by the rust-in-peace security pipeline.