Reject TreeRewriter ranges from another source buffer

[OskarEichler]

Summary

Reject rewrite actions whose Parser::Source::Range belongs to a different Source::Buffer.

Reproduction

target = Parser::Source::Buffer.new('(target)', source: 'alpha')
foreign = Parser::Source::Buffer.new('(foreign)', source: 'bravo')
rewriter = Parser::Source::TreeRewriter.new(target)
rewriter.replace(Parser::Source::Range.new(foreign, 0, 1), 'X')
puts rewriter.process # Xlpha

The offsets happen to fit, so the foreign range silently rewrites unrelated target bytes. Importing another rewriter already checks buffer identity; direct public rewrite actions should enforce the same invariant.

Verification

• Packaged-runtime suite: 1,112 runs / 567,022 assertions, zero failures/errors/skips
• Focused CLI/rewriter model: 14 checks, zero failures
• Foreign-buffer model now raises ArgumentError; normal/import behavior remains covered by the full suite
• 78 shipped Ruby/executable files are syntax-clean; downstream RuboCop inspects 4,195 files with no offenses

This is source-only and does not change valid same-buffer rewrites.

[marcandre]

No objection, it could be better to be strict about this.

I'd add a test
I think the check in merge! would become redundant