feat: replace DocumentManager with RAII MusicXml

[webern]

Human Summary

This fixes a very old and very bad design, the DocumentManager is no more. This should be a little more RAII friendly, though the footguns in C++ are pretty astounding after writing Rust for years.

Summary

DocumentManager was a singleton returning numeric document ids, holding a map of shared_ptr<Document>, and requiring the client to call destroyDocument by hand. The registry, the ids, the badDocumentId error code, and the getUniqueId counter all existed only to support that scheme.

They are gone. The public entry point is now a move-only mx::api::MusicXml that owns its core::Document and frees it at scope exit:

auto doc = MusicXml::fromFile(path);            // Result<MusicXml>
auto score = intoScore(std::move(doc).value()); // consumes the doc, frees the tree at return
auto doc = fromScore(score);                    // Result<MusicXml>; can fail with a write refusal
doc.writeToFile(out);                           // Result<void>
auto copy = doc.clone();                        // deep copy
auto& core = doc.getCoreDocument();            // escape hatch: edit the core DOM directly

The free functions are the score conversions: getScore (const, non-consuming), intoScore (by value, consumes and frees the tree at return), and fromScore (authors a new document; can fail with the core writer's refusal errors). All entry points preserve the Result error boundary: parse/serialize failures return ioError, xmlSyntaxError, the mirrored core parse codes, or internalError for any caught exception. A moved-from MusicXml holds a valid, empty document rather than a null pimpl, so every operation on it stays safe. getCoreDocument is an escape hatch for when mx::api does not do what you need and you want to edit the core DOM directly; it requires including the private mx::core headers and is not recommended (open an issue first).

PartWriter's synthesized <score-instrument> ids used to come from DocumentManager::getUniqueId; they are now a process-wide std::atomic<int> counter inside PartWriter, seeded at the same high value so they still avoid collisions with ids already present in parsed documents.

Scope

• New: src/include/mx/api/MusicXml.h, src/private/mx/api/MusicXml.cpp.
• Removed: src/include/mx/api/DocumentManager.h, src/private/mx/api/DocumentManager.cpp, src/private/mxtest/api/DocumentManagerTest.cpp.
• Result.h: badDocumentId removed; boundary comments updated to MusicXml.
• Tests, examples, and the README ported from the id/destroyDocument dance to RAII ownership. DocumentManagerTest is replaced by MusicXmlTest, which also pins the moved-from behavior.
• Only the api/impl layers change; mx::core, the generator, and the roundtrip baseline are untouched.

This is a breaking change to mx::api. Client code (komp, denigma) that called DocumentManager::getInstance() must move to MusicXml / fromScore / getScore / intoScore.

Testing

• MX_RUNNING_IN_DOCKER=1 make api-build builds mx + mxtest + the three examples + the api-roundtrip binary.
• MX_RUNNING_IN_DOCKER=1 make api-test: all tests passed (5495 assertions in 602 test cases). All three api examples ran successfully.
• make fmt-check passes.
• make fmt / fmt-check could not run locally (the lima docker VM mounts ~ read-only, so the container cannot run clang-format -i into the source tree); the CI fmt-check will run.

References

• Closes Use RAII for the DocumentManager #95
• Progresses the error-boundary work tracked by Consider a different error or warning mechanism. #432 (the MusicXml boundary preserves the Result quarantine DocumentManager had).