845882297cd22aeb22135aecf95aebbe4638842a  [css-text-decor] Negative text-decoration-inset is clipped when the decoration propagates to a descendant inline box

Classified as not security-relevant.
Triage note: collectInkOverflowForTextDecorations walks the ancestor chain to root() taking the max text-decoration overflow per edge instead of only the immediate parent. Rendering/repaint-rect correctness, bounded loop, no memory-safety bug.
This commit was flagged by the signal scorer and reviewed by AI (not a human). It is listed only so the triage is auditable; there is no root-cause analysis because this is not a vulnerability fix.

Structural signals: smartptr_member_added (+4.87), null_guard (+1.2), clamp_saturate (+3.88), msg_medium (+2.0), msg_noise (-2.5), area:Source/WebCore/layout (+2.0), surgical (+1.3)