perf(userscripts): reduce redundant DOM scans and renders

[jackhai9]

Frequent quote updates, media mutations, and panel ticks performed repeated document scans, layout reads, and DOM replacement. This change reduces that work in six userscripts while preserving their data, lifecycle, and trading contracts.

• Reuse the validated depth geometry within one synchronous host paint and the validated Strategy27 chart root within one context tick.
• Retain Trading Data footer elements and Strategy29 rows on empty increments; nonempty increments share one sorted list for retention and rendering.
• Scan only mutation-affected videos, deduplicate them within the existing animation frame, and reject videos removed or adopted into another document.
• Match CMC labels before reading layout or ancestor text and coalesce mutation batches into one animation-frame scan.
• Bump and regenerate Orderbook 2.7.206, Trading Data 1.1.16, Strategy27 0.6.4, Strategy29 0.5.4, and m3u8 0.10.38; update the hand-maintained CMC helper to 0.2.9. Install URLs are unchanged.

The audit covers all eight repository-owned scripts. Deterministic examples reduce CMC layout reads from 6,020 to 8, video scans from 100 to 1, and Strategy29 list replacements across ten empty increments from 10 to 0. These are operation counts from controlled fixtures, not live-page CPU or memory measurements. The report and reproduction commands are in docs/userscript-performance-review.md.

Validation: all 1,017 unit/DOM tests and all 80 Chromium tests passed with retries disabled on Node 24.16.0. All five generated artifacts exactly match current source builds and the tested SHA-256 values; all eight install scripts passed syntax checks and the staged diff passed whitespace validation. Chinese and numeric symbols, including 龙虾USDT and 4USDT, remain covered by inspected Chromium depth fixtures. The CMC fixture's initial UTF-8 declaration defect was fixed before the final complete browser run.

Validation limits: the user-browser inspection during implementation was blocked by the browser caller-identity policy, and no logged-in Brooks export was exercised. Independent read-only review attempts did not return a verdict because model services were unavailable. Installed-source readback and post-reload live-source verification are separate release checks.