Engine: the macro recorder keeps a step's own sheet, stays bounded, and can be cancelled

Six fixes from a review of the recorder, each with a regression test (four
fail against the old recorder; the other two bound work that grew with the
input):

- A step that names another sheet with its sheet parameter (cell.set and
  about fifty other commands) was tokenized as if on the input's sheet, so a
  recorded cell.set {sheet: Two, cell: C4} ran on Two at the input's
  relative place. Such a step keeps its references, like a sheet-qualified
  one.
- Inlining recorded runs of other macros and scripts stops at the macro's
  step limit and counts the rest in dropped, instead of expanding every run
  first (a thousand runs of a long macro made millions of steps).
- macro.record {cancel: true} ends a recording without saving it: the way
  out of a recording whose macro is too large for the workbook, which could
  neither be saved nor ended.
- Formula tokenization reads each reference in the formula and matches it,
  instead of listing every column and row of the example (an example as
  large as a sheet made a million candidates per formula).
- A selection of several areas keeps its active cell as it is; a token for
  the active cell alone put it outside the areas on playback.
- Steps recorded in another workbook are counted in dropped.

docs/macros.md

@@ -120,7 +120,8 @@ of the step that just ran, and the cells changed so far.
 
 `macro.record` toggles recording (`relative: false` for absolute references; `name` and
 `description` when stopping; a name that another macro has gets a suffix, such as `Tidy (2)`, so
-stopping never replaces a macro). The macro is saved in the workbook where recording started, even if
+stopping never replaces a macro; `cancel: true` ends a recording without saving it, the way out of
+one whose macro is too large for the workbook). The macro is saved in the workbook where recording started, even if
 another one is active; if that workbook was closed, stopping ends the recording without saving it.
 When saving the recording fails (a name the check refuses, a workbook at its macro limit, a
 macro being debugged in that workbook), recording goes on, so stopping again keeps what was