fix(audits): avoid nested effect false positives

[miguel-heygen]

What

Fix two audit false positives reported by a cursor-driven UI composition:

• gsap_fullscreen_overlay_starts_visible no longer treats an absolutely positioned inset: 0 child inside an explicitly sized parent as a canvas-covering overlay.
• text_box_overflow now measures a control's direct text nodes without including transformed decorative descendants such as ripple or glow effects.

Why

The static GSAP rule inferred canvas coverage from an element's own CSS without considering its constrained ancestor. The runtime layout audit selected an entire control's contents, allowing a scaled decorative child to inflate the text range and misattribute intentional effect overflow to the control label.

How

• Resolve the nearest authored ancestor from parsed HTML ranges and exempt only absolute inset children whose non-root parent declares both width and height; fixed/root-level overlays retain the existing protection.
• Prefer direct-text Range measurement when an element owns text nodes, while preserving descendant-aware fallback behavior.
• Add regression fixtures for the reported 500×42 constrained banner and a button with a scaled decorative ripple.

Test plan

• Unit tests added/updated
• Manual testing performed
• Documentation updated (if applicable)

Validation performed:

• bun run --filter @hyperframes/lint test (359 passed)
• bun run --filter @hyperframes/cli test -- src/commands/layout-audit.browser.test.ts (31 passed)
• bun run --filter @hyperframes/lint typecheck
• bun run --filter @hyperframes/cli typecheck
• bunx oxfmt --check on changed files
• bunx oxlint on changed files
• pre-commit fallow audit clean

[miguel-heygen]

Final review at current head f86a56db780977684b7850bd4f061ee8dae33f99: code is clean on inspection, required CI is green, and no unresolved review threads remain. The nested explicit-size parent guard is narrowly scoped to absolute overlays; browser + GSAP regression coverage is present. Local GSAP tests pass 82/82; the browser test could not run in this worktree because shared happy-dom is unavailable, but GitHub CI is green. I cannot submit an approval because this PR is authored by the reviewing account; this is a positive review comment for a human stamp.