Block/float: fix BFC-beside-floats edge cases (full-height overlap, negative margins, flow-root)

[nicoburns]

Objective

Fix the remaining Blitz WPT failures in the "BFC (new formatting context) beside floats" group. Per CSS2 §9.5, a box that establishes an independent formatting context must not overlap floats: it narrows beside them or moves below, and its margins interact with float edges specifically.

Three issues are fixed (rebased onto main after #1061/#1062/#1064/#1065, which fixed overlapping cases; the margin-absorption semantics from those PRs are preserved):

1. Full-height overlap — the fit-check only considered the float segment at the box's top edge, so a tall BFC root could overlap a wider float band lower down. find_bfc_slot now takes the box's top edge y and its height (instead of min_y/clear/after) and unions the float insets (and per-side float presence) over all vertically-intersected segments; the caller measures the box at each candidate position (via RunMode::ComputeSize) and advances past float-segment boundaries (next_bfc_candidate_y) until the full border box fits:

   pub fn find_bfc_slot(&self, y: f32, height: f32, containing_block_insets: [f32; 2],
                        margins: [f32; 2], direction: Direction) -> BfcSlot
   pub fn next_bfc_candidate_y(&self, y: f32) -> Option<f32>

2. Negative top margins — a BFC root pulled up by a negative top margin may sit (partially) above a float when it fits beside it, and moves below when it doesn't (previously it was always clamped down to the float segment's top).

3. BFC root height with floats — a BFC root's float-derived height now includes its bottom padding/border below the floats' bottom margin edge.

Context

Verified against blitz main (which is on taffy 0.13 / rev d4a2b3bf) + this patch on the full css/CSS2/floats + css/CSS2/floats-clear WPT subsuites:

• Before: 227 PASS / 110 FAIL / 0 CRASH of 337 run
• After: 244 PASS / 93 FAIL / 0 CRASH — 17 newly passing, no regressions

Newly passing tests:

• css/CSS2/floats/floats-wrap-bfc-004.xht
• css/CSS2/floats/floats-wrap-bfc-with-margin-004.html
• css/CSS2/floats/floats-wrap-bfc-with-margin-005.html
• css/CSS2/floats/floats-wrap-bfc-with-margin-010.html
• css/CSS2/floats-clear/floats-bfc-003.html
• css/CSS2/floats/floats-wrap-top-below-bfc-001l/001r/002l/002r/003l/003r.xht (6 tests)
• css/CSS2/floats/floats-wrap-bfc-003-left-table.xht, floats-wrap-bfc-003-right-table.xht
• css/CSS2/floats-clear/float-replaced-height-001.xht
• css/CSS2/floats-clear/floats-101.xht
• css/CSS2/floats/zero-space-between-floats-003.html
• css/CSS2/floats/zero-width-floats-positioning.tentative.html

(The remaining test in the group, floats-wrap-bfc-006.xht, is blocked on table-caption support in blitz.)

Five new gentest fixtures cover the fixed behaviours (generated expectations verified against Chrome), including a display: flow-root case now that main supports Display::FlowRoot. cargo test, cargo fmt and cargo clippy --workspace are clean.

Note: running the WPT suites against latest taffy main required locally adding the new known_dimensions_are_definite field (from #1003) to blitz's two LayoutInput initializers in blitz-dom/src/layout/inline.rs — blitz will need that one-liner when it next bumps taffy.

Link to Devin session: https://app.devin.ai/sessions/bd32f9420a3346a0be428cc02c532d0d
Requested by: @nicoburns

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR that start with 'DevinAI' or '@devin'.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring