Move every DOM write into onStateChange (GUIDE-RJS-004) for:
codemirror.gadget, codemirror-merge.gadget, crib_enable_validator,
page_tools, page_crib_loader, gadget_interface_loader.

gadget_interface: audited instead of rewired — getOrDeclareGadget is
only ever invoked from onStateChange, so its progress writes already
belong to the state paint; routing them through changeState would
deadlock on the non-reentrant changestate mutex (documented inline).

Deployed to cribjs.nexedi.net and verified: 22/22 smoke checks,
QUnit 48 tests / 113 assertions green, tools + crib_loader scope
links painted by the new onStateChange branches.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>