Seed SVG partial relayout root from fragments tree - #11125

Switch the subtree-relayout seed for in-flow SVG roots from the
read_paintable_geometry callback to the arena side table the previous
commit introduced, so the seed no longer reads the old paint tree. The
in-flow SVG arm of is_partial_relayout_boundary now also requires the
saved-geometry flag, which moves the "has this root ever committed"
check from boundary collection time to registration time: an SVG root
that never committed refuses registration up front and lets the
invalidation reach an outer boundary, instead of aborting the whole
partial attempt at collect time, so partial-vs-full pass counts can
shift for such roots. The old paintable handed to the pass entry is
now used only as the commit splice target.

Nothing reads it since the partial relayout seed switched to the arena
side table; this removes the last geometry read-back from Rust layout
into the paint tree. FfiPaintableGeometry stays on as the side table's
payload type.

The paintable a partial relayout replaces was resolved during boundary
collection and threaded through every layer down to begin_commit, which
could already resolve it from the commit root on its own. Do that:
begin_commit takes the root's paintable and falls back to the one the
DOM node still references (and the paint tree keeps alive) when the
tree builder rebuilt the root's box, and the paintable parameter
disappears from relayout_subtree, the bridge entry points, the Rust
pass entries, and drain_and_commit_entry_pass.

The splice-target existence requirement folds into
is_partial_relayout_boundary as the same paintable-or-DOM-referenced
check, replacing the RequireExistingPaintable knob: the rebuilt-box
caller that passed No qualifies through the DOM-referenced arm, and
registration-time callers now also accept a box whose old paintable
only survives through its DOM node, which collection previously had to
re-discover.