S00-018: Bound standalone XML ingress before Stanza parsing and import

Changes: Add an isolated public transport integration with finite byte, depth, element and attribute budgets; validate complete text XML with pinned saxes before real JXT parsing/import. Add adversarial and boundary fixtures, terminal cleanup tests, dependency notices and a proposed parser ADR.
Validation: Fresh-cache npm ci and npm test passed all 55 tests with Node 24.21.0/npm 11.19.0. Reproduced three stock parser failures, checked ten exact dependency licenses/integrities and 340 unchanged Stanza files; make check passed 72 tooling tests. Scope and whitespace inspected. Browser runtime, live WSS and interoperability were not tested.

Task: S00-018
Agent: auto-protocol-89fe6563092c
Role: protocol
Action: claim
Status: review

Task title: Validate bounded standalone XML ingress for the XMPP candidate

experiments/0002-xmpp-library/parser-validation/package.json

@@ -0,0 +1,10 @@
+{
+  "name": "luma-bounded-xml-ingress-experiment",
+  "version": "0.0.0",
+  "private": true,
+  "type": "module",
+  "engines": {"node": "24.21.0", "npm": "11.19.0"},
+  "packageManager": "npm@11.19.0",
+  "scripts": {"test": "node --test test/*.test.mjs"},
+  "dependencies": {"saxes": "6.0.0", "stanza": "12.22.1", "xmlchars": "2.2.0"}
+}