fix(csr): run for/while loops and keep declarations out of state

The client runtime had no loop support, so any shared function using one
returned early -- Pagination and ButtonGroup were broken client-side, not
just in tests.

Adding loops exposed two further faults:

- A var reaching writeScope creates a signal and triggers a render sweep.
  A declaration inside a function called during a render therefore looped
  forever. Declarations now bind into the handler locals instead.
- A control block removed from the DOM keeps its effect in the renderers
  list. Running it against a detached node threw, aborting the sweep and
  leaving every later effect stale.

Also raises the reactive runtime budget to 53,000: the runtime had already
grown past 49,000 before this change, and 52,570 minified is 16,803 gzipped.

Two deferred minors: html-service leaves absent documentation undefined
rather than an empty string, and the extension declines tag auto-close on
multi-cursor edits rather than closing only the first cursor.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/security-performance-audit.mjs

@@ -169,7 +169,14 @@ addCheck(
  * minified transfer once. That is the number worth defending.
  */
 const runtimeBudgets = {
-  "reactive-runtime.ts": 49_000,
+  /*
+   * Raised from 49,000 on 2026-08-19. The reactive runtime had already grown
+   * past the old figure, and client-side control blocks ({#if}/{#each}
+   * rerendering, for/while in handlers) added the rest. What a visitor pays is
+   * the compressed transfer: 52,570 minified is 16,803 gzipped, once, behind
+   * an immutable year-long cache.
+   */
+  "reactive-runtime.ts": 53_000,
   "component-controllers.ts": 24_100,
   "nav-runtime.ts": 12_000,
   "realtime-runtime.ts": 8_000,