test(compat-eslint): bottom-up parity sweep + phantom-types invariant

Hardens the test suite against the bug class fixed earlier in this
PR (JSXAttribute.parent corruption via phantom TSJsxAttributes).
Master's tests had three blind spots:

  1. lazy-estree.test's `compare()` walks tree TOP-DOWN through child
     getters, where parent is set correctly even on master. Bottom-up
     `materialise(tsNode)` (what tsScanTraverse does on selector match)
     was never exercised. The function also explicitly skips the
     `parent` field — so even top-down parent-chain corruption would
     not have failed parity.
  2. compat-pipeline's JSXAttribute listener pushed `attr:${n.name}`
     events but never read `n.parent`, leaving the listener-API parent
     contract unverified.
  3. Nothing checked the invariant "no node has a 'TS<KindName>' type
     for kinds typescript-estree elides" — the property the
     TSJsxAttributes regression directly violated.

Three new test blocks address each:

  Bottom-up parity sweep (lazy-estree.test): 9 JSX-attribute fixtures
  (self-closing, non-self-closing, spread, sibling attrs, multi-attr
  mixed, fragment, nested attr value, deeply nested), each walks every
  TS node, runs `lazy.materialise(tsNode, ctx)`, and compares the
  resulting type / parent.type / parent.parent.type against eager's
  `astMaps.tsNodeToESTreeNodeMap` lookup. Eager parents are stitched
  ourselves (typescript-estree's astConverter doesn't set parent —
  ESLint's SourceCode does that downstream). 117 type asserts + 108
  parent asserts on the fix branch; 7 unique mismatches on master.

  Phantom-types invariant (lazy-estree.test): 5 comprehensive fixtures
  (jsx-attrs-everything, ts-everything, imports-everything, patterns-
  everything, jsx-fragment-mix), each walks via visitor-keys and ALSO
  bottom-up materialises every TS node that has an eager counterpart.
  Asserts no produced type starts with 'TS' AND isn't in typescript-
  estree's published TS-* type list. The published list is hard-coded
  inline (~75 entries) so the test fails immediately if a future
  PR-added GenericTSNode fallback emits a name not in eager's spec.

  JSX listener parent assertion (compat-pipeline): test #7's
  JSXAttribute / JSXSpreadAttribute listeners now also assert
  `parents[0] === 'JSXOpeningElement'` — the contract any
  jsx-a11y / react/jsx-* rule relies on. The contract is correct in
  spec; whether each listener path independently fails on master
  depends on whether sibling listeners pre-warm the cache top-down,
  but the assert still locks the contract from inside the actual
  ESLint listener API surface.

Out of scope (real but unrelated impedance with eager that the broad
sweep also surfaces — left as separate follow-ups):
  - export wrapper identity (lazy maps the TS node to ExportNamed/
    DefaultWrapper, eager maps to the inner declaration)
  - chain-expression wrapping for `a?.b?.c`
  - destructuring with defaults
  - CatchClause param lifted from ts.VariableDeclaration shim
  - TSStringKeyword / TSVoidKeyword direct-on-Signature

Author: johnsoncodehk

packages/compat-eslint/test/compat-pipeline.test.ts

@@ -1981,10 +1981,36 @@ type D = Awaited<Promise<number>>;
 		'JSX: JSXAttribute listener fires on `id="root"`',
 		calls.some(c => c.selector === 'JSXAttribute'),
 	);
+	// Parent chain via bottom-up materialise: the master regression had
+	// JSXAttribute.parent = 'TSJsxAttributes' for the non-self-closing case
+	// and = 'JSXElement' for self-closing. The contract is that the parent
+	// is JSXOpeningElement (synthetic for self-closing) — typescript-estree
+	// shape that JSX rules rely on. Pin it from inside the listener path
+	// so any future regression to the parent chain fires here too.
+	{
+		// Fixture has exactly one JSXAttribute (`id="root"`), so first hit.
+		const attrCall = calls.find(c => c.selector === 'JSXAttribute');
+		check(
+			'JSX: JSXAttribute.parent === JSXOpeningElement (bottom-up via listener)',
+			attrCall?.parents[0] === 'JSXOpeningElement',
+			`got parents: ${JSON.stringify(attrCall?.parents.slice(0, 3))}`,
+		);
+	}
 	check(
 		'JSX: JSXSpreadAttribute listener fires on `{...rest}`',
 		calls.filter(c => c.selector === 'JSXSpreadAttribute').length === 1,
 	);
+	// Same parent-chain pin for spread-attribute — different lazy-estree
+	// path (JsxSpreadAttribute is a TS kind, not a wrapped expression),
+	// so verify independently.
+	{
+		const spread = calls.find(c => c.selector === 'JSXSpreadAttribute');
+		check(
+			'JSX: JSXSpreadAttribute.parent === JSXOpeningElement',
+			spread?.parents[0] === 'JSXOpeningElement',
+			`got: ${JSON.stringify(spread?.parents.slice(0, 3))}`,
+		);
+	}
 	check(
 		'JSX: JSXExpressionContainer listener fires on `{count && ...}`',
 		calls.some(c => c.selector === 'JSXExpressionContainer'),
@@ -2052,7 +2078,13 @@ type D = Awaited<Promise<number>>;
 					events.push(`open:${n.name?.name ?? '?'}`);
 				},
 				JSXAttribute(n: any) {
-					events.push(`attr:${n.name?.name ?? '?'}`);
+					// Read parent.type — the field that the TSJsxAttributes
+					// regression silently corrupted. Real ESLint plugins
+					// (jsx-a11y, react/jsx-*) read this constantly to scope
+					// rules to the enclosing tag. Asserting it here exercises
+					// the bottom-up materialise path with parent semantics
+					// from inside the actual ESLint API surface.
+					events.push(`attr:${n.name?.name ?? '?'}:parent=${n.parent?.type ?? 'NONE'}`);
 				},
 			};
 		},
@@ -2071,7 +2103,11 @@ type D = Awaited<Promise<number>>;
 		events.includes('open:div') && events.includes('open:span'),
 		`events: ${events.filter(e => e.startsWith('open:')).join(',')}`,
 	);
-	check('JSX+CPA: JSXAttribute fires on `id="x"`', events.includes('attr:id'));
+	check(
+		'JSX+CPA: JSXAttribute fires on `id="x"` with parent=JSXOpeningElement',
+		events.includes('attr:id:parent=JSXOpeningElement'),
+		`events: ${events.filter(e => e.startsWith('attr:')).join(',')}`,
+	);
 }
 
 // 9. JSX rule with real esquery selector + report mechanism — mirrors