Match live numeric in-range and out-of-range states #462

Parent: #257

Proven gap

WebScene parses :in-range and :out-of-range, and input/textarea values already have a live property/native-edit/reset invalidation path. The matcher has no range-state branch, and the current live-value checkpoint only distinguishes empty from nonempty values, so numeric boundary crossings cannot update styles.

Focused implementation

• classify finite live values for input[type=number] and input[type=range] against valid min/max bounds;
• use range defaults of 0/100 and the implied midpoint when a range value is empty;
• match :in-range and :out-of-range, leaving empty/invalid number values in neither state;
• compile type, min, max, and a dedicated live-range dependency;
• extend the existing live form-value checkpoint so nonempty-to-nonempty boundary crossings recascade only when range classification changes.

Deferred validation debt

This implementation-only slice intentionally skips browser/WPT/native correctness runs, build, performance, allocation, memory, lifecycle, scene/pixel, product, hosted checks, and CI monitoring. Those remain required before #257 acceptance.

Date/time/month/week types, step mismatch, bad-input sanitization, full constraint-validation APIs, user-valid/user-invalid, and complete form-owner behavior remain outside this child. Consolidation PR #76 is untouched.