Make paint-placement maintenance incremental (O(damage), not O(tree))

[nicoburns]

Summary

Stacked on #805 (this PR's branch includes #805's commits; the diff reduces to the three commits below once #805 merges). Removes the avoidable O(tree) per-frame work from the paint-placement side of the OOF hoisting branch, with no behavior change. Three independent commits:

1. Hoisted paint-child positions are derived at use-time, not baked.

 pub struct HoistedPaintChild {
     pub node_id: NodeId,
     pub z_index: i32,
-    pub position: taffy::Point<f32>,
 }

Paint, hit-testing, and compute_content_size now compute the offset via Node::hoisted_child_position(child_id), which accumulates location - scroll_offset along the child's containing_block() chain (the OOF containing block for hoisted boxes, otherwise layout_parent) up to the owning node (with a negated walk for the effect-ancestor case where the owner is below the containing block). Since nothing baked can go stale, layout/scroll changes elsewhere no longer require re-baking every hoisted entry.

2. attach_hoisted_children no longer scans the whole node slab.

BaseDocument gains oof_containing_blocks: HashSet<NodeId>, maintained by Taffy's OOF callbacks (add_hoisted_children inserts, clear_hoisted_children removes). Attach iterates only these registered containing blocks (sorted for determinism, lazily pruning removed/emptied ones), so its cost is bounded by the number of OOF boxes, not document size.

3. flush_styles_to_layout skips clean subtrees (incremental mode).

Damage propagation already bubbles descendant damage into each ancestor's stored damage, so damage.is_empty() && !has_damaged_descendants() && !is_anonymous() proves the whole subtree is unchanged: its taffy styles, layout_children order-sort, paint_children, and stacking contexts are all still valid, and the flush returns early. The one piece a skipped subtree still owes its surroundings — the HoistedPaintChild entries it contributed to the nearest ancestor stacking context — is replayed from a per-node sc_contribution_cache captured on the last flush that visited it, so a damaged ancestor SC that rebuilds its list keeps entries from clean descendant subtrees. This makes the flush's per-frame cost O(damaged nodes).

Not addressed (intentionally): the tree-order splice and is_before_in_tree_order are unchanged (same ordering semantics as the base branch), Appendix E step-8 interleaving remains approximate (grid-items-relative-positioned-containing-block-003 still fails), and attach still visits every registered CB each frame — it can't be safely damage-gated because a rebuilt ancestor stacking context needs clean CBs' z-indexed entries re-pushed.

Testing

• Per-test WPT comparison vs the Integrate Taffy out-of-flow hoisting support #763 baseline (55127ef) over css/css-position, css/CSS2/positioning, css/CSS2/zindex, css/css-grid/grid-items, css/css-grid/abspos, css/css-flexbox: zero status differences.
• After rebasing onto Integrate Taffy out-of-flow hoisting support #805 (2cbce9b0): cargo test --workspace, cargo clippy --workspace, cargo fmt all clean.

Link to Devin session: https://dioxus.staging.devinenterprise.com/sessions/2641a1705e2547a0b385ec07a70a3abb
Open in Devin Desktop: https://dioxus.staging.devinenterprise.com/desktop/session/2641a1705e2547a0b385ec07a70a3abb?variant=devin-insiders
Requested by: @nicoburns

[staging-devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR that start with 'DevinAI' or '@devin'.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring