fix(state): surface an initialization failure instead of hanging silently - #264

Round 2 of #257, from three adversarial reviews of the first landing.

- Re-registering the SAME element on a root is idempotent, so a DOM
  move during load no longer rejects a healthy element.
- The failed-root marker lives only while the failed element is still
  attached, so a corrected root adopts volumes that connected in the
  recovery window.
- The pre-initialize awaits (bind-component, DCC) land the same way;
  fail-fast paths that already resolve their own promises pass through
  untouched.
- The rootNode-getter raise is enumerated and pinned.
- The duplicate-root message now tells the author the second element
  stays unregistered and must be removed.

Docs: the volume wording narrowed to what the code does, the stray
blank line under the 2.3.0 heading removed, and an SSR design-doc line
citation refreshed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Round 3 of #257. Round 2 classified an element detached mid-load as an
initialization failure, which put a diagnostic, a permanent rejection
and element poisoning on pages with no author error at all. A pooled
element (remove then append) stayed rejected forever even after it
initialized and rendered, and @wcstack/server and @wcstack/testing
await that promise.

- `_initialize` reports completion instead of dereferencing a root node
  that is gone; the connection ends quietly and the next connect
  settles the promises, matching main.
- The `$connectedCallback` call carries the generation guard that
  startWatch and startStreams already had, so a DOM move during load no
  longer runs the author's callback twice.
- Volume slot reservations are released when a volume is orphaned or
  when a settled, never-grafted volume leaves the DOM.
- The README and CHANGELOG now split the failure sites by what they do
  to connectedCallbackPromise rather than by feature name.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Round 4 of #257. Round 3 added a slot release so a corrected root could
adopt a volume again, and it produced two measured defects: releasing
by the current mount attribute freed another live element's
reservation, and a volume detached mid-load kept its slot with no path
left to free it. The reservation has had no release path since before
this work, so it is an ownership bug of its own rather than part of
this fix.

- The release and its call sites are removed; reserveVolumeSlot and
  the ledger are back to their previous behaviour.
- Round 2's orphan landing stays: volumes waiting on a root that fails
  settle with one report each.
- The docs no longer claim a slot is released, and say instead that an
  orphaned volume does not re-graft when a corrected root appears.
- The failure-site enumerations now include the silent mount fail-fast
  class and the fifth raw bind-component raise.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…guarantees

Rounds 5 and 6 of #257. Each round of prose about which failure site
rejects, resolves loudly, or resolves silently introduced a new false
claim: a slot release that does not happen, a volume source failure
called a rejection, a silence that is not silent, a companion report
that usually is not there.

The classification is now written at the grain that is robustly true.
A root element's initialization failure rejects and reports once. A
volume never rejects; some volume failures report nothing of their
own, and the error leaves as the discarded connectedCallback promise.
A detach during load rejects nothing. Readers who need the exact
behaviour of one site are pointed at the test that pins every case.

The SSR design note now names the function it actually quotes instead
of a line number that keeps drifting.

Documentation only: no source behaviour, no test assertion and no test
title changed, and the suite stays at 3269 tests.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>