[mcollina]

Define safe, unambiguous coordinates for automatically managed input.

parse() and position now report only bytes consumed from the current call's input, excluding any retained prefix. parsed continues to count every stream byte exactly once.

Event and callback ranges index an explicit event_data backing buffer. Without a retained prefix this is the caller's current input; when managed bytes are prepended, Milo owns the aggregate until the next parse, reset, or destruction. Rust exposes an unsafe accessor with the unmanaged-input lifetime contract, C++ can read the fields directly, and WebAssembly exposes pointer/length getters.

The retained buffer continues to contain only the unconsumed suffix. Mirrored Rust/WASM regressions validate current-call counts and exact aggregate backing bytes, while the allocator regressions verify bounded ownership and release behavior.

Full Rust/fuzz, C++ reference, and 98-test WASM validation passes. Independent review found no blockers.

This fixes SEC-06 from #38.