fix(dom): reduce transient allocation during serialize (PER-10135)

[rishigupta1599]

Context — PER-10135

Customer (RS Components / LCNC, Selenium SDK) sees intermittent renderer OOM / browser disconnects during PercyDOM.serialize on long (~50 min) sessions, both Chrome and Firefox.

Root cause (investigated + reproduced)

Not a memory leak. A single serialize produces a large transient allocation burst (full DOM clone + full HTML string + string copies + JSON.stringify/bridge marshalling). On a customer SPA already near the renderer/VM memory ceiling (telemetry p50 heap ~1885 MB) in a constrained Automate VM, that one-shot burst intermittently tips the renderer over.

• Reproduced deterministically only under a hard memory cap (docker --memory): identical 45k-node/315 MB page survives at 2 GB (heap sawtooths & recovers) but crashes on the first serialize at 1.1 GB. Roomy hosts can't repro it (--max-old-space-size doesn't bound a renderer) — which is why earlier attempts failed.
• Leak ruled out: 100 serializes on one tab → post-GC heap flat (~0.0005 MB/snapshot), live DOM node count constant (90,004 → 90,004), heap-object graph +0.06% (noise).

What this PR changes (safe, output-preserving)

Two reductions to Percy's per-snapshot transient footprint:

1. serialize-dom.js — fold the two marker-rewrite .replace() passes (custom-element proxies + serialized attributes) into a single regex pass, halving large-string allocation churn on the hot tail of every capture. Output verified byte-identical against representative inputs.
2. clone-dom.js — in getOuterHTML, when there are no shadow roots to embed, return docElement.outerHTML directly instead of the getHTML() → textContent='' → outerHTML.replace() reassembly, avoiding a full-size intermediate string + a replace on the common no-shadow-DOM page.

Honest scope

This is a mitigation, not a complete OOM fix — the reproduction shows the full DOM clone dominates the transient peak, so these string-copy savings don't move a tight boundary on their own. Larger follow-ups (streamed/chunked snapshot transfer to avoid the in-renderer JSON.stringify + bridge double-marshal; capping huge inline content; customer guidance) are tracked in PER-10135.

Testing

• @percy/dom karma test suite passes.
• Combined-regex output verified byte-identical to the prior two passes.
• No-leak validated across 100 serializes (see above).

🤖 Generated with Claude Code