fix: walk a style's parent chain instead of recursing it, and read an xml part once - #691

🤖 Generated with Claude Code

Two native crash clusters from Play (14 Aug 2026), both document-driven.

Stack overflow in StyleRegistry::generate_style_

A w:basedOn / style:parent-style-name chain was resolved one stack frame per link, so a document declaring enough styles in one chain overflowed the stack of the thread that opened it — an http worker's, which is small. Both registries now walk the chain onto a stack and build it from the root down. The cycle guard is unchanged in meaning: an entry present but still null.

ooxml_text_style_test.cpp resolves a 100 000-link chain on a thread, so it runs on the small stack rather than the process's. Against the old recursive code it kills the test binary; against this it passes in ~85 ms. Also covers inheritance, a cycle, and an unknown parent.

Double buffering in xml::parse

pugixml's stream loader holds every part twice — the chunk list it reads into, then the contiguous buffer it parses in place. Zip entries know their uncompressed size, so the part is read once into a buffer pugixml is handed and frees. This lowers peak memory for the reported pugixml OOM aborts; it does not eliminate them, since Scudo aborts inside malloc rather than returning null.

Verification

• Full suite: 880 passed, 0 failed — including the reference-output comparison, which is what shows the parse change is byte-identical.
• clang-format and clang-tidy clean on the changed files.

The third cluster in the same triage (DynamicUnit::to_string() SIGSEGV) needs no change here: it is an unguarded frame.width()-> in v6.5.0, already fixed on main by 734b6cc and not yet released.