perf(wab): build token and image-asset dictionaries once per call

[jameswillis99]

Summary

Closes #643, in the Branch merge performance milestone. The change lands on this fork first. After it proves itself here, it goes upstream to plasmicapp/plasmic as a separate PR.

On the server, maybeComputedFn never caches, so site invariants and compareSites rebuilt the all-deps token and image-asset dictionaries once per token, tpl or rule set.

 compareSites(prev, curr)
   hashRuleSet(ruleSet)                    // runs for every rule set on both sides
-    allTokensDict = siteFinalStyleTokensAllDepsDict(site)
+    allTokensDict = getTokensDict(site)   // built once per site per call, passed down

 usedTokensForExp / tplToUsedImageAssets
-  build the dictionary on every call
+  build it at most once per call, and only when a ref needs resolving

Final tokens are now classified with a set lookup per token instead of array scans. toFinalToken takes an optional isMember argument, and the final style token selectors pass setMembership() once per batch. Callers that pass nothing scan as before.

Outputs do not change. The upstream-merge runbook and ep-fork-integrity.spec.ts list the change, so that an upstream merge does not drop it.

Evidence

• Before: on the 15k-instance synthetic site, interleaved with master's code: 4,168 token dictionary builds per compareSites, 3,459 per all-updated tryMerge and 810 asset dictionary builds. compareSites took 3.0–3.1 s, genSiteErrors 3.2 s, and an all-updated tryMerge 13.9–15.0 s.
  After: 2 builds per compareSites, 588 per tryMerge and 0 asset builds. compareSites took 40–45 ms, genSiteErrors 240–270 ms, and tryMerge 7.3–8.1 s. A partial tryMerge goes from about 6.0 s to 4.7–4.9 s.
• On the repo fixtures the gain is smaller. compareSites over 348 pairs goes from about 4.7 s to about 0.6 s, componentToUsedImageAssets over 77 sites from about 2.6–3.0 s to about 0.12 s, and genSiteErrors from about 3.2–3.6 s to about 0.4 s. The small bundle merges are flat. The machine was loaded, so times are approximate.
• Old and new output is byte-identical (diff -rq): used tokens and assets and genSiteErrors over 77 sites, changelog JSON and release type over 348 compareSites pairs, and 25 tryMerge runs, in node and in jsdom with observable sites.
• New specs fail on the old code and pass now: dictionary build counts and the set lookup. Characterization specs for used tokens, used assets and compareSites pass before and after. The shared, site-diffs, model and bundler specs pass, and branching.spec.ts passes 17 of 17 on Postgres 14.

Merge Danger

Door: two-way

A revert restores the old code. There are no data, schema or API changes.

Blast Radius: publish, merge and invariants

compareSites runs in publishProject (up to three times per real merge), createBranchFromBase, webhooks and the Studio merge flow. Site invariants run in tryMerge and in Studio. Each reused dictionary lives inside one synchronous call that only reads the site, so a future edit must keep those calls free of writes to tokens or image assets. No error path moves: on a corrupt dependency with no site, getValidRefs walks every dependency before componentToUsedTokens runs, so the TypeError comes from the same place as before.