bug: three parse-path regexes run quadratic on malformed input #453

Security review findings (medium, CWE-1333; ~1 s at ~50 KB adversarial input).

• dedent in packages/text-fine/src/surface.ts strips the trailing blank run with /\n\s*$/; on failure the tail is retried from every position.
• parseAttributes in packages/recipe/src/parser.ts matches <sheet> attributes with /([a-z][a-z0-9-]*)\s*=\s*(["'])(.*?)\2/g; a long run of name characters backtracks once per position.
• Parameter source ranges in packages/studio/src/parameters.ts locate name = with a regex anchored at the prefix end; every offset is retried.

Proposed fix: replace all three with linear scans (backward whitespace scan, hand attribute parser, backward prefix scan) — same accepted language, same error codes and produced ranges.

Fix: #445