refactor(define): parse widget XML with xmlm (#16)

[GG-O-BP]

Summary

• replace the handwritten widget XML regex/string scanner with xmlm on the JavaScript target
• move deterministic widget XML serialization into pure Gleam while preserving the established byte layout
• return and report typed parsing failures instead of silently constructing partial widget models
• remove the XML parser/serializer exports and model-constructor imports from define_ffi.mjs
• cover namespaces, comments, CDATA, entity decoding, attribute ordering, optional/default values, nested groups, enumerations, return/type constraints, interleaved system properties, exact serialization, and malformed input

Compatibility

• preserves the widget model and all property type mappings
• preserves studioProCategory with studioCategory fallback
• preserves source order of property and systemProperty
• preserves deterministic root attribute order, indentation, optional element order, and trailing newline
• keeps the declared glendix -> mendraw dependency on Hex

Validation

Passed on the candidate commit:

• gleam format --check
• gleam check
• gleam build --warnings-as-errors
• gleam docs build
• gleam test --runtime bun (66 tests after rebasing onto current main)
• scripts/dependency-mode.sh check-commit glendix 465bc5a
• family style, FFI-contract, repository-boundary, generated-source checks
• standalone consumers for glendam, glendix, mendraw, and mxpak
• justin_fork, glendix, mendraw, mxpak, and Glendam browser test suites
• fixture widget build and MPK inspection
• Lustre browser E2E
• Mendix 11.12.0 build and browser E2E

The single-command shared/final wrappers were also exercised. Their repeated fresh Hex resolutions hit the unauthenticated Hex API rate limit in this environment, and the detached validation worktree needed the explicitly selected committed Chrome path plus refreshed transient harness manifests for the already-merged Glendix 6.0.0 baseline. All constituent source, browser, widget, Lustre, and Mendix gates passed after those environment-only adjustments.

Closes #16