feat: composite figures are a container the server knows

[dereuromark]

Carries the composite-figures vocabulary into the server. Part of markup-carve/carve-grammars#222; spec PART 9 §4c, landed as markup-carve/carve#1215, design markup-carve/carve#1122.

What was wrong

A bare ::: figure fence parses to a figure_group node. The server switches on node.type in four places, each with a default that does nothing, so a node type the engine grew and the server never learned is invisible rather than a type error: the container simply stopped folding, hovering and producing semantic tokens, and all 238 tests stayed green.

Input:

::: figure
![one](a.png)
^ (a) One
:::
^ Figure #: Group caption

Before: no fold, no hover, no token on the opener, no token on the caption line.

The control, which must not change:

::: figure "A titled figure div"
![one](a.png)
^ (a) One
:::

That opener is not the composite-figure production at all. It parses to admonition and keeps every behavior it had.

What changed

File	Change
src/folding.ts	figure_group joins FOLDABLE
src/semantic.ts	the opener's reserved kind word is scoped type, and the group caption is collected beside the children
src/hover.ts	its own description, naming what separates it from the container it resembles
src/completion.ts	::: offers figure, listed separately from the eight admonition kinds
src/composite-figure.test.ts	new

Two details are deliberate. The caption is collected on the GROUP rather than from any child, because it sits after the CLOSING fence - that placement is the one thing §4c adds to §4, and reading it from a child yields no token at all. And figure is offered separately in completion, labelled Composite figure: folding it into the eight would say it is a ninth admonition, which is the confusion the clause exists to prevent.

The dependency moves to a git pin

@markup-carve/carve was pinned to the published 0.1.3, which predates the node - figure_group is not in its type union, so a case for it would not have compiled. It now tracks the carve-js commit that carries composite figures. Mid-development a git pin is the correct pin; it moves back to a version range at the next release.

A codex pass caught the consequence, fixed in the second commit. package.json declares the pin as git+https://, and the generated lockfile recorded git+ssh://git@github.com/ for the same dependency, because this machine's git config rewrites the HTTPS form to SSH via insteadOf. npm ci follows the LOCKED url, so CI would have failed with Permission denied (publickey) on a public repository, before a line compiled, with nothing in the diff to suggest why. Rewritten to HTTPS - which is what tree-sitter-carve's lockfile carries for the same dependency - and verified by deleting node_modules entirely and installing from the lockfile.

Tests

src/composite-figure.test.ts asserts the engine's shape first, so a dependency that stops producing figure_group says that plainly instead of reporting four unrelated feature failures. The titled and labelled openers run as the control throughout: they differ from the bare one only in the tail of one line, so a reading that fires on the kind word alone would call them groups and nothing else would notice.