Check every undo on a copy of the document before running it

Review found that keeping a peer-touched block while deleting its own
attribute entries left documents that no longer opened, that Yjs could
pass over a no-op step to an unchecked one removing a projection, and
that the timer-based reaction window dropped real keystrokes.

Each undo or redo now replays on a copy first, including Yjs's pass over
no-op steps, and runs only if it deletes nothing another client wrote,
leaves every protected projection's MDX unchanged, and reads the same
from a fresh load as applied live. Otherwise the history ends there.
The reaction window is now a few microtasks, which input cannot enter.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>