test(site-builder): cover loadState's orphan-repair wiring via PageProvider

Review found Task 8's prescribed test never mounts PageProvider, so it
never exercises loadState -- deleting the repairOrphanNodes call would
still leave that suite green. Adds a PageProvider-mounted test driving
switchPage into a page with a stored orphaned node, asserting on what
loadState hands to actions.deserialize and that console.warn fires.
Verified load-bearing: temporarily neutering the repair call fails the
new test (ROOT.nodes missing 'stray'), then restored.

Also documents the fallback-branch invariant that `fallback` must
always be a known-safe constant, per review.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

craft/src/state/PageContext.tsx

@@ -393,6 +393,11 @@ export const PageProvider: React.FC<{ children: ReactNode }> = ({ children }) =>
         } catch (e) {
           console.error('Failed to deserialize state:', e);
           try {
+            // NOT run through repairOrphanNodes: `fallback` must always be
+            // one of the module's own known-safe constants (EMPTY_CANVAS /
+            // EMPTY_HEADER / EMPTY_FOOTER -- true at all current call sites),
+            // never untrusted/stored data, since this is the last line of
+            // defense before giving up silently below.
             actions.deserialize(fallback);
           } catch (_e2) {
             // give up