[inth3shadows]

Closes #19.

Fixes a parser livelock: a .tsx file containing <a {{b:>c:d(e f) (tree-sitter-typescript upstream colbymchenry#323, fork inth3shadows/tree-sitter-typescript#16) timed out its parse worker three times (3 x 30s) and was then dropped from the index.

Root cause: tree-sitter's error recovery (tree-sitter/tree-sitter#5997), not the grammar. The fix shipped only in 0.27.1, and web-tree-sitter 0.27 rejects wasm with the legacy dylink section. Every tree-sitter-wasms 0.1.x grammar and the vendored Dart use that section, so the straight bump failed 193 tests. Instead, this vendors 0.25.10's runtime built with the 3-line patch.

	before (npm 0.25.10)	0.27.1 bump	this PR
PoC project (2 files)	92s, poc.tsx dropped	1.46s	1.43s, both indexed
full suite	1 failed (busiest-symbol, pre-existing)	193 failed	0 failed, 10549 passed

Changes:

• src/extraction/runtime/tree-sitter.wasm (sha256 d48b82be…), loaded through Parser.init({ locateFile }) in initGrammars(), which throws if the file is missing.
• copy-assets copies it to dist/extraction/runtime/, and check-ui-build fails a build without it (the bundle copies all of dist).
• web-tree-sitter is pinned exactly at 0.25.10.
• __tests__/tsx-error-recovery-hang.test.ts: two hang inputs × tsx/typescript must parse within 2s, plus a glue-version guard.
• docs/grammars/web-tree-sitter-runtime.{md,patch}: provenance, rebuild steps, exit plan.

Verified:

• Reproducibility: the same build without the patch is byte-identical to npm's 0.25.10 tree-sitter.wasm (f38dcc4b…).
• Regression test with npm's unpatched runtime swapped in: × tsx 2007ms … did not finish within 2000ms. With the vendored runtime: 3 passed.
• tsc --noEmit exit 0; npm run build exit 0 (runtime ok).
• npm audit: 7 advisories, identical on main (vite/vitest/rollup/svelte dev tooling).

Round 1 review fixes (8d405ac):

• Native kernel patched too (closes Native kernel: tree-sitter 0.25 error-recovery livelock on TSX (#5997) still hits kernel-routed parses #19). codegraph-kernel/vendor/tree-sitter is the crates.io 0.25.10 crate, whose parser.c is identical to the git tag's, with the same patch, wired in through [patch.crates-io]. The kernel hang test runs extractFile in a child with a 10s timeout: the unpatched crate gives tsx ETIMEDOUT; the patched one passes 5/5.
• Dev scripts (ts-differential, add-lang/dump-ast, add-lang/check-grammar, gen-go-stdlib-methods) and grammar-wasm-bytes.test.ts now init through the vendored runtime (scripts/tree-sitter-runtime.mjs). dump-ast on the PoC: exit 124 -> 0.
• check-ui-build checks the dist runtime's sha256: npm's wasm swapped in -> exit 1.
• Results with the kernel built: full suite 11099 passed, 0 failed; kernel tests 312 passed; ts-differential exit 0 (0 new / 0 worse); PoC 1.63s with the kernel loaded.
• Filed: Indexing: cancel parses on a budget instead of kill-and-retry (deterministic timeouts cost 3 x 30s + a dropped file) #20 (cancel indexing parses on a budget instead of kill-and-retry).

Exit plan: rebuild the legacy-dylink grammars, move both paths to tree-sitter 0.27.1+, and delete the vendored runtime and crate.