Match read-only and read-write element states #452

Parent: #257

Proven gap

WebScene already reflects input.readOnly/textarea.readOnly, stores readonly, disabled, type, and contenteditable attributes in the native DOM, and models disabled fieldset ancestry. Selectors parse :read-only and :read-write, but both currently fall through as unsupported.

Focused implementation

• match mutable text-capable input/textarea controls as :read-write and their readonly/disabled counterparts as :read-only;
• consume inherited contenteditable=true/empty and contenteditable=false boundaries for ordinary HTML elements;
• match other elements as :read-only;
• compile bounded readonly, disabled, type, and inherited contenteditable invalidation routes.

Deferred validation debt

This implementation-only slice intentionally skips browser/WPT/native correctness runs, build, performance, allocation, memory, lifecycle, scene/pixel, product, hosted checks, and CI monitoring. Those remain required before #257 product acceptance.

Document designMode, richer editing-host behavior, :indeterminate, range states, user-valid/user-invalid, and complete form ownership/reset behavior remain outside this child. Consolidation PR #76 is untouched.