fix: creepjs stealth, AudioBuffer, Crypto, Worker, hasIframeProxy

Worker auto-execution: Worker constructor resolves relative URLs against
location.href, fetches the script, and auto-runs it. WorkerGlobalScope is
exposed so IS_WORKER_SCOPE resolves correctly. Worker data (navigator,
locale, timezone) now arrives via postMessage within the 3s timeout.

AudioBuffer class added to globalThis with getChannelData, copyFromChannel,
copyToChannel. AudioContext.createBuffer returns a real AudioBuffer. Fixes
ReferenceError that blocked the audio fingerprint section.

Crypto class added to globalThis with randomUUID and getRandomValues on its
prototype. Fixes ReferenceError in getPlatformEstimate.

AudioContext.addEventListener was a no-op; startRendering only fired
oncomplete. Add _listeners map and dispatch to stored listeners.

getElementById and querySelector('#id') returned null for elements inserted
via replaceChild(documentFragment, el). id_index only registers nodes at
creation time; .or_insert skipped IDs on cloned fragments; None caused
query_selector_from to short-circuit the full scan.
Fix querySelector: fall through to full scan on index miss or stale entry.
Fix getElementById: verify node is in live document; fall back to attribute
selector scan if not.

contentWindow getter: return null when parentNode is null (iframe was never
inserted into any tree). Previously returning null for all disconnected
iframes broke getBehemothIframe, which caused PHANTOM_DARKNESS to fall back
to self (main window) instead of the phantom iframe. That made DOC point to
the main document, so rect and font measurements wrote fragment nodes into
the main body, and the subsequent full-DOM scan in getElementById could not
find fingerprint-data through nested fragments in time.

Limiting the null return to parentNode===null (never inserted) means
getBehemothIframe gets a valid nested contentWindow as expected. creepjs
now reports hasIframeProxy: false and 0% stealth detection.

DocumentFragment constructor: pass nid through when provided.
Range.getBoundingClientRect / getClientRects: return commonAncestor rect.

crates/obscura-dom/src/selector.rs

@@ -565,11 +565,11 @@ impl DomTree {
                 // querySelector matches strict descendants of root only, so the
                 // indexed element must have root among its ancestors.
                 Some(nid) if self.ancestors(nid).contains(&root) => return Ok(Some(nid)),
-                // No element has this id at all: a bare id selector cannot match.
-                None => return Ok(None),
-                // Indexed (first) element is not under a scoped root; a later
-                // duplicate could still be a descendant, so fall through to scan.
-                Some(_) => {}
+                // Index miss or stale entry (detached node) — fall through to full scan.
+                // The id_index is best-effort: it only registers nodes at creation time
+                // and does not update on reparent, so it can point to a detached clone
+                // while the live node (with the same id) is elsewhere in the tree.
+                _ => {}
             }
         }
         let selector_list = parse_selector(selector)?;