toml_edit: pushed [[array]] element can steal earlier sub-tables

In toml_edit 0.25.17 (main as of 2026-10-29), pushing a Table onto an ArrayOfTables can place the new [[x]] header between the previous element's sub-tables when those headers are written out of tree order, e.g. [[bin]]\n[bin.x.y]\n[bin.x]\n + push => [[bin]] [bin.x.y] [[bin]] w=1 [bin.x], so [bin.x] silently moves into the new element. Cause: Display gives a position-less (new) table the position of the table visited just before it in tree order, then stable-sorts by position. Fix idea: a position-less table takes the highest position seen so far under its parent (not the global max, which breaks other layouts). Workaround in callers: set an explicit position on the new table (Table::set_position) larger than every position in the previous element's subtree. Related but distinct: toml-rs/toml#1083.