fix(oxml): scope CT_GroupShape.max_shape_id to spTree descendants

The xpath `//@id` in `CT_GroupShape.max_shape_id` is absolute — it
scopes to the whole document, not the spTree subtree. On slide masters,
that pulls in the sentinel ids on `<p:sldLayoutIdLst>/<p:sldLayoutId>`
which start at 2147483649 (PowerPoint's authoring convention for
layout-master pointer ids — a deliberately-segregated namespace).

The next-shape-id calculation `max_shape_id + 1` then returns a value
just above `xs:int` (2147483660). PowerPoint quarantines shapes with
ids in that range on open, surfacing as a 'Repair' dialog that removes
the offending shape and synthesizes replacement parts.

The latent bug was harmless until Phase 5 (#52) introduced
`MasterShapes.add_textbox` and `SlideMaster.add_text_watermark` — the
first public API that *writes* a shape to a slide master. Reads off
masters didn't exercise `_next_shape_id`.

Fix: change `self.xpath('//@id')` to `self.xpath('.//@id')`. `.//` is
the descendant-or-self axis relative to the context node — scopes the
search to the shape tree only, leaving sibling-element ids
(`p:sldLayoutId`, etc.) outside the max.

Tests:
- `it_returns_zero_for_max_shape_id_on_an_empty_spTree` — baseline.
- `it_finds_the_max_id_among_shape_descendants` — sanity, picks
  max=42 across three sp ids.
- `but_it_ignores_sibling_ids_outside_the_shape_tree` — regression
  pin: `<p:sldLayoutIdLst>` siblings with ids in the 2147483649+
  range do NOT inflate the result. spTree.max_shape_id stays at 2.

Verification (local, CPython 3.14.4):
- python3 -m pytest tests/ -q                       → 3654 passed (+3 vs Phase 5 baseline)
- python3 -m ruff check src tests                   → All checks passed!
- python3 -m ruff format --check src tests          → 216 files already formatted
- python3 -m behave features/ --no-color            → 1048 scenarios, 0 failed
- python3 uat/uat_headers_footers_phase5.py         → script runs clean;
  watermark shape_id=7 (was 2147483660 pre-fix). UAT signoff is
  maintainer-only per CLAUDE.md §6a — please re-open the regenerated
  uat/out_headers_footers_phase5.pptx in PowerPoint to confirm.

Refs #52.

Author: MHoroszowski

src/pptx/oxml/shapes/groupshape.py

@@ -149,16 +149,24 @@ def iter_shape_elms(self) -> Iterator[ShapeElement]:
 
     @property
     def max_shape_id(self) -> int:
-        """Maximum int value assigned as @id in this slide.
-
-        This is generally a shape-id, but ids can be assigned to other
-        objects so we just check all @id values anywhere in the document
-        (XML id-values have document scope).
-
-        In practice, its minimum value is 1 because the spTree element itself
-        is always assigned id="1".
+        """Maximum int value assigned as @id within this shape tree.
+
+        This is the maximum @id value on any descendant of this `<p:spTree>` (or
+        `<p:grpSp>`) element. Scoped strictly to the shape tree because OOXML
+        uses sibling element-types (notably `<p:sldLayoutIdLst>/<p:sldLayoutId>`
+        on a slide master) whose `@id` values live in a deliberately-segregated
+        namespace starting at 2147483649. Pulling those values into this max
+        would push the next shape id beyond `xs:int`, which PowerPoint quarantines
+        on open ("Repair", with the offending shape removed).
+
+        In practice the minimum return is 1 because the spTree element itself is
+        always assigned `id="1"`.
         """
-        id_str_lst = self.xpath("//@id")
+        # ---`.//@id` (not `//@id`) — `//` is absolute in XPath and scopes to the
+        #    whole document, picking up sibling-element ids that share neither the
+        #    semantic namespace nor the id range with shape ids. See the docstring
+        #    for the failure mode that surfaced via SlideMaster.add_text_watermark.
+        id_str_lst = self.xpath(".//@id")
         used_ids = [int(id_str) for id_str in id_str_lst if id_str.isdigit()]
         return max(used_ids) if used_ids else 0
 

tests/oxml/shapes/test_groupshape.py

@@ -88,6 +88,41 @@ def it_calculates_its_child_extents_to_help(self, child_exts_fixture):
         x, y, cx, cy = xSp._child_extents
         assert (x, y, cx, cy) == expected_values
 
+    def it_returns_zero_for_max_shape_id_on_an_empty_spTree(self):
+        spTree = element("p:spTree")
+        assert spTree.max_shape_id == 0
+
+    def it_finds_the_max_id_among_shape_descendants(self):
+        spTree = element(
+            "p:spTree/(p:nvGrpSpPr/p:cNvPr{id=1,name=root}"
+            ",p:sp/p:nvSpPr/p:cNvPr{id=2,name=a}"
+            ",p:sp/p:nvSpPr/p:cNvPr{id=42,name=b}"
+            ",p:sp/p:nvSpPr/p:cNvPr{id=7,name=c})"
+        )
+        assert spTree.max_shape_id == 42
+
+    def but_it_ignores_sibling_ids_outside_the_shape_tree(self):
+        # ---Regression for the slide-master shape-id-overflow bug surfaced by
+        #    SlideMaster.add_text_watermark: `<p:sldLayoutIdLst>` lives as a
+        #    sibling of `<p:cSld>` on a slide master and uses sentinel ids
+        #    starting at 2147483649. A whole-document xpath would pull those
+        #    values in and push the next shape id past `xs:int`, which
+        #    PowerPoint quarantines on open ("Repair" path).
+        sldMaster = element(
+            "p:sldMaster/(p:cSld/p:spTree/(p:nvGrpSpPr/p:cNvPr{id=1,name=root}"
+            ",p:sp/p:nvSpPr/p:cNvPr{id=2,name=title})"
+            ",p:sldLayoutIdLst/(p:sldLayoutId{id=2147483649,r:id=rId1}"
+            ",p:sldLayoutId{id=2147483650,r:id=rId2}))"
+        )
+        spTree = sldMaster.find(
+            "{http://schemas.openxmlformats.org/presentationml/2006/main}cSld/"
+            "{http://schemas.openxmlformats.org/presentationml/2006/main}spTree"
+        )
+        # ---scoped to spTree descendants; 2147483649 etc. are NOT counted---
+        assert spTree.max_shape_id == 2
+        # ---and `_next_shape_id` (max + 1) stays in the safe shape-id range---
+        assert spTree.max_shape_id + 1 == 3
+
     # fixtures ---------------------------------------------
 
     @pytest.fixture