script: fix replaceChild panic when old child is not a child of this node

[nicoburns]

Summary

dom/nodes/Node-replaceChild.html crashed with Option::unwrap() on a None value in DocumentMutator::insert_nodes_before (mutator.rs:646): replace_child called insert_nodes_before(old_id, ...) unconditionally, and the anchor's parent.unwrap() panics when the "old child" has no parent (e.g. a.replaceChild(b, c) where c was never inserted).

Fix in replace_child (blitz-vibey-script), per the DOM spec's replace steps:

• throw HierarchyRequestError if the new node is an inclusive ancestor of the context node (spec step 2) — this previously could also create a cycle in the node tree
• throw NotFoundError if the old child's parent is not the context node (spec step 3) — this was the panic
• expand DocumentFragments via insertable_node_ids (matching insert_before/append_child)

WPT result goes from CRASH to FAIL 9/29 subtests passing; remaining failures are the unimplemented full pre-insertion validation (node-type checks, document child constraints, doctype handling) which is a larger piece of work. No change to Node-insertBefore/appendChild/removeChild results.

Link to Devin session: https://dioxus.staging.devinenterprise.com/sessions/967f095dfc0a48d3b73b3f13a579372b
Open in Devin Desktop: https://dioxus.staging.devinenterprise.com/desktop/session/967f095dfc0a48d3b73b3f13a579372b?variant=devin-insiders
Requested by: @nicoburns

WPT results

No changes in test results compared to main.

_{Generated by the WPT workflow.}

[staging-devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR that start with 'DevinAI' or '@devin'.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring