Cap total paint-graph node visits in COLRv1 painting

[scadastrangelove]

Closes #221.

Adds a visits_left: u32 field to RecursionStack (initialized to a new
MAX_PAINT_VISITS: u32 = 100_000 constant in Table::paint, its only construction site) and a
consume_visit() method, checked in parse_paint alongside the existing cycle check:

// Cycle detected
if recursion_stack.contains(offset) {
    return None;
}

// Total-visit budget exceeded (a DAG can revisit the same offset via different sibling
// branches without ever cycling on the active path -- see RecursionStack::visits_left)
recursion_stack.consume_visit().ok()?;

recursion_stack.push(offset).ok()?;

Because parse_paint is the single choke point all 25 recursive call sites go through, this
needed no changes to any of them, or to any of the 5 function signatures in the call chain
(paint → paint_impl → paint_v1 → parse_paint → parse_paint_impl).

Testing

• Full suite green: cargo test --all-features --release — 148/149 (pre-existing unrelated
  failure, see Guard CFF2 BLEND operator against empty argument stack #222 for detail).
• depth=18/branching=3 (16–20+s before) now completes in ~3.6ms, paint() called 66,658
  times (bounded by the new budget, as expected); depth=20/branching=3 (didn't complete in
  20s before) now completes in ~4ms.

---

Discovered by the rust-in-peace security pipeline.