HTML: repair pathological small-chunk allocation guard baseline

[joris97jansen]

Problem

The opt-in HTML allocation guard streaming_parser_chunk_sizes_do_not_cause_pathological_alloc_growth fails on clean master, so it cannot currently distinguish feature-branch regressions from the repository baseline.

Measured on 2026-07-24 with:

CARGO_TARGET_DIR=/private/tmp/borrowser-ae13b1-alloc-target RUST_TEST_THREADS=1 cargo test -p html --test alloc_guards --features 'html5 count-alloc' --locked streaming_parser_chunk_sizes_do_not_cause_pathological_alloc_growth -- --exact --nocapture

Clean master:

small=740000988 large=13252104

AE13b1 working tree (for comparison only):

small=743357684 large=16256864

Both runs fail the existing threshold. AE13b1 must not weaken or rebaseline this guard.

Required outcome

• identify the production allocation source under small streaming chunks;
• make the guard pass on clean parser behavior without weakening its regression signal;
• preserve whole/chunked parser output and counter equivalence;
• keep any threshold adjustment evidence-based and isolated from parser-conformance feature work.