fix(mermaid-text): prevent UTF-8 parser panics and harden class methods

[worldnine]

Fixes #50 while preserving the original UTF-8-safe keyword helper change and author commit by @worldnine.

Class parsing handles Japanese/Cyrillic names without panicking. GPT-6.1 review also reproduced and fixed three pre-existing variants: Unicode whitespace in class methods, malformed class-method parentheses, and Unicode relationship separators in ER diagrams. Regression tests pin exact AST structure and diagnostics. The local advisory gate required a narrow Rustls 0.23.45/webpki 0.103.15 lockfile update; no advisory ignore was added.

Validation on macOS: cargo fmt --all -- --check, cargo clippy --workspace --all-targets -- -D warnings, cargo test --workspace on stable and Rust 1.92, cargo deny check bans licenses sources advisories, cargo audit, and cargo doc --no-deps --workspace all pass. Default docs retain existing link warnings. The original regressions and newly discovered variants were verified failing before fixes. Independent GPT-6.1 security and tests passes are complete.

Review/findings and variant audit are committed in PR-51-review.md and docs/audit-utf8-parser-variants-2026-10-12.md. Contributor credit is included in both changelogs; versions are markdown-tui-explorer 1.35.2 and mermaid-text 0.57.3. No release or publish was triggered.

Closes #50

[leboiko]

I am reviewing this fix with the existing regressions and the full workspace checks. I will build any needed additions on your commit and retain your authorship. Thank you for the reproduction and fix.

[leboiko]

GPT-6.1 review: the UTF-8-safe helper reuse is correct and preserves ASCII behavior. One minor test finding: pin the exact colon-shorthand parse diagnostic rather than accepting any error. I will address this on top of the contributor commit and run full local checks. No implementation defect found.

[leboiko]

GPT-6.1 independent security and test review found additional pre-existing panic variants; these are not regressions introduced by the contributor commit. I am fixing all three in this PR under the no-follow-ups requirement.

• Critical — crates/mermaid-text/src/parser/class.rs:362: +String\u{3000}吠える() slices one byte past a multi-byte Unicode separator and panics. Slice at the matched separator and trim whitespace.
• Critical — crates/mermaid-text/src/parser/class.rs:341: +吠える)( forms a reversed byte range and panics. Validate parentheses and only search for a closing delimiter after the opening one.
• Critical — crates/mermaid-text/src/parser/er.rs:471 and :484: the same whitespace-plus-one pattern panics on 顧客\u{3000}||--o{ 注文 : places and on the right separator. Both relationship token splitters must use a character-boundary slice.

The three strong reproductions failed locally before implementation (exit 101), with exact boundary and range panics. All additions will preserve the contributor commit and credit. The local advisory gate also required a narrow Rustls/webpki lockfile update; no advisory ignore was added.

[leboiko]

GPT-6.1 fix-review-findings completed in 6be562932c05856270b1ec4540590aa7eaf1f3b5.

Finding	Severity	Status
Generic shorthand error assertion	Minor	Fixed: exact diagnostic and AST assertions
Class method Unicode separator panic	Critical	Fixed and reproduced before change
Reversed class method parentheses panic	Critical	Fixed: ordered delimiter validation
ER Unicode separator panics	Critical	Fixed: both token splitters
Rustls advisory found by local gate	Security gate	Fixed: patched lockfile; no ignore

All local fmt, workspace clippy, stable/MSRV workspace tests, deny, audit, and docs gates pass. Independent security and tests reviews confirm the fixes. No findings deferred. Contributor author commit remains in history and is credited.