[R16] Reject cyclic object attachments before mutation

[JetF0x]

Addresses review finding R16.

Assigning node.Child = node, adding an owner to its own object collection, or attaching a root beneath one of its descendants could create a parent cycle and hang dirty-state propagation. Generated property setters and both object collection types now share a reference-based ownership validator that rejects these attachments before changing either side. The validator also detects an already cyclic owner chain without allocating on each assignment.

Deserialized list and dictionary replacements now validate before detaching the previous value. Add 49 regression cases covering property/list/dictionary self and ancestor attempts, rejected replacements, conflicting owners and slots, collection duplicates, identity no-ops, and valid reparenting after detach. Rejection checks preserve parent metadata, collection contents, clean or pending dirty state, serialized payloads, and events.

Generated consumer code can access the protected internal helper. Document that runtime and generator versions must be paired and consumer assemblies rebuilt to obtain the new setter guard; serialized schemas and wire data are unchanged.

Validation: .NET SDK 10.0.400, full Release suite 277 passed (204 runtime, 20 generator, 53 analyzer). Before the fix, property/list/dictionary self-attachment tests each hit an isolated VSTest five-second hang timeout, and both deserialized replacement tests failed because no exception was thrown. The existing MemoryRelayTransport.cs:21 nullable warning remains.