tree: heightOf walks children with no cycle guard, so a corrupted parent pair overflows the stack instead of refusing the move #677

What

plugins/tree/src/tree.js in #636 adds

const heightOf = (nodes, id) => {
  const kids = childrenOf(nodes, id)
  return kids.length ? 1 + Math.max(...kids.map(k => heightOf(nodes, k))) : 0
}

with no cycle guard, while its neighbours in the same file both have one: depthOf walks parent with seen = new Set(), and traceOf stops at 64 hops. heightOf walks children, so a corrupted snapshot in which two Bots are each other's parent (A.parent = B and B.parent = A — what a half-applied move_bot or a hand-edited flybot-tree field leaves behind) recurses until the stack dies, so move_bot throws RangeError: Maximum call stack size exceeded instead of refusing the move.

Acceptance

1. heightOf takes and threads a seen set, exactly like depthOf: a node already on the current path ends the walk instead of being re-entered.
2. A test that builds a snapshot with a two-node parent cycle and calls the move path (move_bot) on a third Bot: it must return a refusal or a warn, not throw RangeError. The assertion is assert.doesNotReject plus the refusal text — a test that merely catches the stack overflow does not count.
3. The other invariants stay: cycles, duplicate names, maxChildren and maxDepth still refuse with their current errors.
4. plugins/tree suite green at the tip.

Red without the fix: the new test throws RangeError: Maximum call stack size exceeded.

Scope: plugins/tree/src/tree.js + one test; no docs change (the invariant is internal); if core/ is touched (it should not be), ds-bot-patches generate + check.

Written-by: Triage