parser: HTML and CSS front end on tree-sitter, with specification and torture suites

[JaredHLZhang]

What this adds

One web front end for .html/.htm/.xhtml and .css, read into seventeen relations (all-html-*.csv, all-css-*.csv) the way the configuration formats are read: every scan target, structurally, nothing rendered. Trees come from tree-sitter-html 0.23.2 and tree-sitter-css 0.23.0; what either grammar rejects but the language allows is re-read from the source text and marked recovered rather than reported as a gap.

• Pages: documents with doctype and template dialects, elements as written with XPath-like paths, attributes by kind, class tokens, every URL a page names classified and resolved to a file (honouring <base href>, for the page's own <style> and style="" too), scripts with their body range (inside inline <svg> as well), handler calls from on* attributes, javascript: URLs and framework event bindings, and template expressions (v-for declares its loop variables, @click="save(id)" is a call, :class a binding, {{ user.name }} an interpolation; Angular, Alpine, Jinja, Handlebars, ERB and the rest likewise).
• Sheets: rules and at-rules as a tree including nesting, selectors with specificity, simple selectors with combinators, declarations, the names values refer to (custom properties, URLs, imports, keyframes, layers, containers, font families), comments and gaps.
• Per-language mode copies the web tables into every java/, javascript/ and typescript/ folder that exists. No engine reads them yet; the frozen schema and .decl lines are under parser/src/schema/web/.

Tests

• npx tsx src/test/web-tests.ts: the specification suite (format checks with the implementation each rules out, fixture golden, key uniqueness, FK integrity, schema arity and domains, determinism, enum-emission audit). 32 checks, green.
• npx tsx src/test/web-torture.ts: the adversary, over a project written to hold every trap a static reader meets, asserting the joins row by row with a DEFECT/GAP/LIMIT verdict per check. 79 checks, green; 17 GAP/LIMIT findings are reported as the explicit list of what the front end does not yet do (browser tree repairs, CDATA in XHTML styles, quoted @keyframes names, image-set() URLs, Svelte/htmx handlers, …).
• parser/tools/web-corpus-bench: development-only oracle against parse5, htmlparser2, css-tree and postcss over downloaded corpora, with its dated baseline.
• Also run on this branch: typecheck, build, discovery, services and JavaScript suites.

Notes

• Direct push to apps/integration-0.1.9 was declined by the protected-branch hook, hence this PR. The parser version stays at this branch's 0.1.3.
• Leak check done over the whole changeset: no local paths, identities or secrets; binary fixtures are empty or tiny text placeholders; .gitattributes exempts the one CRLF torture fixture from normalisation because its line endings are the case under test.

🤖 Generated with Claude Code

[swapnilpaliwal-sd]

The java failure here is inherited from the base branch, not this PR: the engine-package test's stubbed --prepare dies at the new seqlock header overlay ("could not prepare the patched soufflé headers"), which lands the same 5 failures on any branch — reproduced on the base tip with this PR's changes absent. Fix: #1859. Once it merges, updating this branch from base should turn java green.