fix: harden mdast provenance boundary

[Iktahana]

What changed

• isolate the mdast-only parser and provenance types under @illusions-lab/mdi/internal/mdast
• build a single prefix-max-end interval index and query it only for text-bearing nodes
• make container records structural-only with empty targets and Rust-owned source/synthetic status
• carry Rust-generated frontmatter provenance unchanged onto the remark YAML node
• compare the complete recursive provenance tree across Node, Chromium, Firefox, and WebKit
• add exact acceptance, candidate-scan complexity, release scaling, and cross-binding leakage tests
• record unrelated review findings in CODE_HEALTH.md

Why

PR #78's initial implementation scanned every projection channel for every IR node, exposed an adapter transport through general JS APIs, assigned aggregate targets to containers, and omitted frontmatter from browser parity. This stacked change narrows the API boundary and makes provenance projection scale with indexed units and actual text-bearing matches.

construct.path remains parse-local transient identity and must not be persisted.

Validation

• cargo fmt --all -- --check
• cargo clippy --all-targets --all-features -- -D warnings
• cargo test (71 passed, 1 ignored)
• cargo llvm-cov --locked (97.07% line coverage)
• release 800/1600/3200 nested-list scaling gate (mdast: 21.8 / 45.0 / 96.2 ms)
• pnpm typecheck
• pnpm build
• pnpm test:coverage
• pnpm test:browser (Chromium + retry, Firefox, WebKit)
• Python coverage suite (26 passed, 100%)

Local Swift execution is blocked by the installed toolchain lacking XCTest; Android execution is blocked by the host having no Java runtime. The added binding contract tests compile in their normal CI environments. Publication artifact contracts additionally require the external EPUBCHECK_JAR fixture.

Stack

Base: agent/rust-mdast-provenance (PR #78)

[codecov]

Codecov Report

❌ Patch coverage is 94.14894% with 11 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
nodejs/packages/mdi/src/internal/mdast.ts	0.00%	10 Missing ⚠️
mdi-core/src/text_projection.rs	99.15%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!

[Iktahana]

Superseded: the fully validated hardening commit was integrated into PR #78 before its squash merge, so all changes are now on main in 08fea73.