Renders a vnode subtree into a different ReactLynx element identified by
a `NodesRef` (from `ref={setX}` or `lynx.createSelectorQuery()`), without
requiring any compile-time marker attribute. Implementation routes portal
ops through the existing SnapshotInstance/patch abstraction:

- New `nodesRefInsertBefore` / `nodesRefRemoveChild` patch ops; carried
  via the regular `LifecycleConstant.patchUpdate` channel alongside BSI
  CreateElement / InsertBefore / RemoveChild ops.
- `fakeRoot.insertBefore` wires `child.__parent = fakeRoot` so preact's
  `removeNode` (which walks `child.parentNode.removeChild`) routes through
  portal removeChild, otherwise unmount silently no-ops.
- Pre-hydrate Portal mounts queue into `pendingInsertBefore`;
  `clearPendingPortalInsertBefore` (called from hydrate) replays the BSI
  subtree's dropped CreateElement / SetAttributes / internal InsertBefore
  ops via `reconstructInstanceTree`, then attaches the subtree to host
  via `nodesRefInsertBefore`.
- `reconstructInstanceTree` extracted to its own module so portal's
  pre-hydrate replay can share the helper without forming an import
  cycle with `backgroundSnapshot.ts`.

Different design from #2501 (which uses a `portal-container` SWC
transform to lift the host subtree into a separate snapshot) — this one
stays inside the existing SnapshotInstance/patch model so hydrate diff
and future first-screen-direct-render paths can be reused without
protocol changes.

Tests cover pre-/post-hydrate mount, unmount via `componentWillUnmount`,
container swap, multi-child reorder + prepend, context propagation
across portal boundary, ctx-not-found soft-fail on apply, and host
selector miss; runtime test env gets `__GetPageElement` /
`__QuerySelector` mocks. testing-library suite includes a preact-parity
case ported from internal-preact's `feat/portal-slot` branch verifying
that portal content stays put while host's normal children toggle.

`nodesRefInsertBefore` / `nodesRefRemoveChild` previously soft-failed
when the selector didn't resolve or the BSI subtree wasn't materialized.
That's a caller bug (stale `NodesRef`), so use non-null assertions and
throw instead of silently dropping the op.

- Throw meaningful errors (not raw `TypeError`s) when `nodesRefInsertBefore`
  / `nodesRefRemoveChild` apply hits a caller-bug state — message names
  the op, the childId, the selector, and hints at the most likely cause.
- Move the portal-only apply handlers + selector lookup into a new
  `nodesRefApply.ts` module so `snapshotPatchApply.ts` stays focused on
  snapshot-tree ops.
- Reject non-CSS-selector `NodesRef`s (`selectReactRef`, `selectUniqueID`)
  in `serializeNodesRef` instead of silently no-oping on the main thread.
- Drain matching pending inserts from `pendingInsertBefore` when a portal
  child is unmounted before hydrate, so the queue replay during hydrate
  doesn't resurrect a child that was already torn down on background.
- Switch the container-swap test to assert the portaled subtree actually
  moves from container A to container B.
- Use `toThrowErrorMatchingInlineSnapshot` for the throw-path tests.

`createPortal` is only invoked from the background thread — short-circuit
to `null` on main thread so preact's `render`/`createElement` and the BSI
linkage helpers don't get pulled into the main-thread chunk.

Fixes a typo (`if (__MAIN_THREAD__) null;` was a discarded expression that
left the function falling through), updates the public api-extractor
baseline (`VNode<any>` → `VNode<any> | null`), and updates the runtime
test to assert the early-return on main thread + materialization on
background thread.

Also adds `nodesRefInsertBefore` / `nodesRefRemoveChild` to the
`formatPatch.test.ts` fixture so the params-metadata for those entries
is regression-checked.

The patch buffer is JSON-roundtripped between threads, which converts
the `undefined` slot emitted by `before?.__id` into `null`. The apply
side previously checked `beforeId !== undefined` and silently fell back
to `__AppendElement` when the lookup missed, which masked the wrong
ordering on `__InsertElementBefore` paths.

Switch to `beforeId != null` and assert insertion order in the prepend
test so the regression to the append fallback can't slip back in.

`applyNodesRefRemoveChild` previously only deleted SI entries from the
manager. Mirror the full teardown that `SnapshotInstance.removeChild`
runs:

- `snapshotDestroyList(v)` for `<list>` holders, otherwise native list
  callbacks + `gSignMap`/`gRecycleMap` keep stale state across portal
  mount/unmount cycles.
- Null out `__parent` / `__previousSibling` / `__nextSibling`.
- Drop `__elements` / `__element_root` refs.

Keeps the portal teardown at parity with the regular tree teardown so
future cleanup added to the regular path won't silently miss portaled
subtrees.

Reproducer for the snapshotDestroyList gap fixed in 37cdfbc: spy on
`__UpdateListCallbacks`, render a portal containing a `<list>`, unmount
it, and assert an additional `__UpdateListCallbacks` call (the cleanup
trio that snapshotDestroyList emits) fires.

Verified the test fails on the previous commit (`27da0f68`, no list
teardown) and passes on `37cdfbc0` (with the fix).

The runtime coverage threshold is 100%. The new `snapshotDestroyList`
branch in `applyNodesRefRemoveChild` (37cdfbc) was only exercised by
the testing-library suite, which doesn't feed runtime coverage — so
test-react/Vitest runners both failed at the threshold check.

Add a runtime-level unit test that builds a list-holder SI directly
via `__SNAPSHOT__(<list>{HOLE}</list>)`, runs `nodesRefRemoveChild`,
and asserts `snapshotDestroyList`'s observable side effects (cleanup
trio replaces the real list callbacks, manager entry deleted).