Decouple kMaxUserCallDepth's guard from callStack_.size()

[revarbat]

Summary

• Fixes a real regression found while verifying 0.13.2 against Anklet.scad end-to-end: ERROR: Recursion too deep while calling function 'ident'.
• enterUserCall's own depth guard checked callStack_.size() directly — but callStack_ also grows from cheap, zero-native-cost compiled module-call pushes (skipDepthGuard=true, Op::CallModule via pushBracketedModuleFrame), which cost no real native stack at all (serviced by driveVm's own heap-based loop). Those pushes still counted toward the SAME threshold a later genuinely interpreted call (skipDepthGuard=false) is guarded by — the exact same class of bug driveVmNativeDepth_ already exists to avoid for the other guard site.
• Fix: a new nativeUserCallDepth_ counter, incremented/decremented only for skipDepthGuard=false pushes, checked instead of callStack_.size().
• New regression test proves it, and is confirmed to actually fail without the fix (verified by temporarily reverting it locally).
• Bumps to 0.13.3.

Known follow-up still outstanding (not fixed here)

Anklet.scad now gets past translate/multmatrix/color-wrapped recursion (0.13.2) and past the ident() false trip (this PR), but still doesn't fully render: children() (BOSL2's own children-forwarding mechanism) is the next and last remaining native-reentry source. Unlike the constructs Op::PushBuiltinWrap covers, children() forwards a runtime-varying set of children (resolved dynamically via ctx.childrenNodes/childrenCallerCtx per caller, not statically known from the AST) — so it can't reuse the same "compile children inline" trick. Fixing it needs its own design pass extending the explicit-stack VM to handle a runtime-varying splice target.

Test plan

• Full oscad_eval_tests suite green (714/714), both OSCAD_BYTECODE_VM=0 and =1.
• New test confirmed to fail without the fix (reverted locally, reproduced the exact "Recursion too deep while calling function" error), passes with it.

🤖 Generated with Claude Code