docs(xml): describe the parser that enforces limits and builds the semantic tree #387

Problem

The public documentation still describes the XML input path that #381 and #386 replaced:

• docs/xmldsig.md and docs/xmlenc.md say a streaming preflight enforces the node and depth ceilings before either parser backend allocates a DOM. An xmloxide parse of a document without a DOCTYPE has no pass before the parser: the parser counts the limits as it reads.
• docs/xml-backend-patches.md says entity fragments are grafted by rebasing links, that scoped replay pays source positions, and that both backend adapters use the shared lexical preflight. xmloxide now builds the semantic tree as it parses and reads replacement text into the same tree; only roxmltree is projected through the scan's positions.
• docs/benchmarks.md describes the projection phase as if every single backend had one; only roxmltree does.

Solution

Describe the current path at each place:

• limits: xmloxide without a DOCTYPE enforces them in the parser; a DOCTYPE document, roxmltree and differential parsing pass one strict lexical scan that checks them while recording positions; either way a refusal comes before the node is stored, and entity replacement work is charged in that scan;
• the xmloxide kernel: generic tree construction into the semantic arena, replacement text with the reference's range, DOCTYPE recognized only by its case-sensitive keyword;
• the projection benchmark: roxmltree only.

Acceptance criteria

• No document claims a pass before every parse or a backend DOM for xmloxide.
• Every limit statement matches src/document.rs (parse_checked, parse_borrowed_in) and src/xml/dom/limits.rs.
• Documentation checks in CI pass.