Fix H2: shared reference-graph guard for standalone walkers (review #006)

Cyclic or over-deep $ref graphs stack-overflowed the three standalone
schema walkers (OffsetMap::compute, LayoutBuilder::new,
materialize_aligned) — SIGABRT on probe, parity-preserved from 0.2.0.

- New src/walk_guard.rs: check_ref_graph() — one bounded walk over the
  reachable reference graph (depth cap 128 matching the plan compilers,
  path-scoped cycle set; diamonds allowed, cycles and 201-def chains
  rejected with the plan compilers' error wording)
- All three walkers run the guard at entry, before any recursion;
  materialize_aligned's is defense-in-depth (a cyclic doc can no longer
  produce an OffsetMap, but mismatched doc/map inputs must still fail
  cleanly)
- Behavioral side effect, net-positive: the guard eagerly parses every
  reachable def, so an invalid non-root def now surfaces at
  LayoutBuilder::new instead of build() — four H3 tests updated to
  expect the same Schema error earlier
- Test family: 12 new tests (walk_guard, offset_map, layout_builder,
  materialize) covering self/two-def/composite-carrier cycles, deep
  chains, and diamond non-rejection; no stack-overflow reproducers
  in-tree per the review's Methodology warning
- Stale "walkers have no cycle guard" statements updated in
  validation.md, 030 plan, ADR-012, and the engine gate comment

Verified: 501 tests green (423 + 17 + 34 + 15 + 12 + 2 ignored),
clippy -D warnings clean, wasm32 build green, cargo doc zero warnings.

docs/architecture/validation.md

@@ -293,11 +293,12 @@ The expensive work happens once at schema load time:
 2. Parse the root struct's `"endian"` annotation.
 3. Compile the `ValidationPlan` — the value-domain constraint tree,
    with eager `$ref` resolution. Its compile walk rejects cyclic `$ref`
-   graphs with a clean `Schema` error *before* the layout computation:
-   the layout walkers' struct/union recursion has no cycle guard, so
-   ordering the plan compile first is what keeps a self-referential
-   (malicious or accidental) document a handleable error, not a stack
-   overflow.
+   graphs with a clean `Schema` error *before* the layout computation.
+   (The layout walkers now also guard themselves — each standalone
+   entry point runs the shared reference-graph check
+   (`walk_guard::check_ref_graph`, review #006 H2) — so the plan-first
+   ordering is belt-and-suspenders at engine compile, and the trust
+   boundary no longer depends on the call path.)
 4. Compute the layout (`LayoutBuilder` for packed, `OffsetMap` for
    aligned).
 5. If `json_schema` is `Some`, build the standard