Implement complete CSS :default form-control matching #474

Parent: #257

Proven gap

WebScene parses :default but the native selector matcher has no implementation, so authored default checkboxes/radios, selected options, and a form's default submit button never match. This affects extension/webview form CSS and keeps the live form-state matrix incomplete.

Implementation scope

• Match checkbox/radio defaults from the authored checked attribute, independent of live checkedness.
• Match option defaults from the authored selected attribute, independent of live selectedness.
• Match the first enabled submit-capable button owned by a form, including explicit form ownership and nested controls.
• Recompute on checked/selected/type/disabled/form/id and relevant child-list changes so a replacement default submitter is styled.
• Keep iframe/document trees isolated.

Deferred validation debt

Per the current implementation-only directive, WPT/browser/native tests, mutation/performance/lifecycle benchmarks, builds, package qualification, and CI monitoring are deferred and must be completed before this issue closes.