Adopt node before removing child in replace

replace removes child (with suppressObservers set) before inserting
node. Because insert now adopts node as one of its steps, when node is
already in the tree its removal from the old location — and the mutation
record that removal queues — happened *after* child had already been
silently removed. That gave the record a stale previousSibling and made
the two records appear non-atomic.

Adopt node up front, before child is removed, so node's removal is
observed while child is still present. This restores the record ordering
and previousSibling that predates #754, which had removed replace's
explicit adoption step without accounting for this interaction. All
engines kept the pre-#754 behavior, so this aligns the standard with
reality.

The related replace all algorithm intentionally keeps adopting inside
insert: its only caller that can receive an already-present node is
replaceChildren(), which postdates #754 and folds such a node into its
single record.

Tests: dom/nodes/MutationObserver-childList.html (existing n52/n53
coverage) and web-platform-tests/wpt#61155.

Fixes #814.

Author: annevk

dom.bs

@@ -3194,6 +3194,11 @@ a <a for=/>node</a> <var>node</var> within a <a for=/>node</a> <var>parent</var>
 
  <li><p>Let <var>removedNodes</var> be the empty set.
 
+ <li><p><a>Adopt</a> <var>node</var> into <var>parent</var>'s <a for=Node>node document</a>.
+ <!-- This needs to come before child is removed below so that, when node is
+      already in the tree, its removal is observed while child is still present.
+      See https://github.com/whatwg/dom/issues/814. -->
+
  <li>
   <p>If <var>child</var>'s <a for=tree>parent</a> is non-null: