The node_wrappers identity cache in DomBridge holds GcRef values that
were not included in collect_roots(), meaning the GC could collect
wrapper objects and break wrapper identity (same DOM node returning
different JS objects across calls). Add cached wrappers as GC roots
so identity is preserved across garbage collection cycles.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Add the bridge between the JS engine and the DOM crate (Phase 11, issue 2 of 8).

- DomBridge struct holds shared Document and wrapper identity cache
- Vm::attach_document() registers document global with structural properties
- document.documentElement, .head, .body, .title properties
- document.getElementById, getElementsByTagName, getElementsByClassName
- document.querySelector/querySelectorAll (reuses css/style selector matching)
- document.createElement, createTextNode factory methods
- Element wrappers with tagName, nodeName, nodeType, id, className
- Wrapper identity: same NodeId always returns same JS object
- NodeId::from_index added to dom crate
- Parser::parse_selectors added to css crate
- 20 tests covering all acceptance criteria

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Add the Console API as built-in JS globals (Phase 11, issue 1 of 8).

- ConsoleOutput trait with configurable output sink (default: stdout/stderr)
- console.log/info/debug write to the log channel
- console.error writes to the error channel
- console.warn writes to the warn channel
- Rich formatting: arrays show contents, objects show properties
- Cycle detection and depth limiting for nested structures
- Vm::set_console_output() for redirecting output (dev tools, testing)
- 14 tests covering all methods, formatting, and channel routing

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>