feat(ifc): integrate advanced settings and consolidate dependency maintenance

[brownie-cake]

Summary

Consolidate the remaining reviewed PRs on merged #276, without duplicate IFC runtimes or individually incompatible Angular upgrades. No npm publication, release tag, package version bump or automatic issue closure.

• Incorporate @p4535992's advanced configuration direction from feat(ifc): add optional IFC preview (BETA) #275: bounded data-only importer/Fragments settings and a pre-model configureRuntime hook. Retain the existing post-load hook, optional entry and owned Workers.
• Reject executable/accessor/prototype/private configuration and Worker/WASM overrides. Preserve library-owned collections and revalidate settings inside the importer Worker.
• Repair two lifecycle defects proven before their fixes: pre-model abort created an orphan Worker; reentrant unmount() from abort/cleanup callbacks returned different Promises and resolved with a Worker still alive. Guard model registration and publish one shared disposal Promise before callbacks execute.
• Combine chore(deps): bump @angular/core from 22.0.7 to 22.1.0 in /apps/component-demo/test/angular-pptx #270/chore(deps): bump @angular/common from 22.0.7 to 22.1.1 in /apps/component-demo/test/angular-pptx #271/chore(deps): bump @angular/compiler from 22.0.7 to 22.1.0 in /apps/component-demo/test/angular-pptx #274 into the complete published Angular 22.1.6 framework/tooling cohort. Incorporate chore(deps-dev): bump vitest from 3.2.7 to 4.1.11 in /packages/thumbnail #261 by matching the thumbnail Vitest declaration to the existing workspace 4.1.11 override.
• Group future Angular version/security updates, add consistency guards, and document every open PR/issue disposition.

Related issue

Refs #267. Supersedes #275, #261, #270, #271 and #274 once this consolidated PR passes its current checks and merges. The original PR commits are not represented as merged.

Credit for the advanced configuration direction: @p4535992, #275 (comment).

Change classification

• User-visible UI or rendering change
• File-format or renderer behavior
• Public API, package, Worker, WASM, or deployment-path change

Verification

Exact reviewed head: 5a37e3b2132cd1afdfda8a9f9605cc51f44ade87. Runtime repair is 0b84e9d5dec5344b990511558c07013d2e1e98e0; the last commit records its evidence.

• pnpm install --frozen-lockfile --filter @flyfish-group/file-viewer-open-source --filter @file-viewer/renderer-3d... — Passed.
• pnpm verify:github-governance — Passed.
• pnpm verify:public-release-facts — Passed.
• pnpm --filter @file-viewer/core build — Passed.
• pnpm --filter @file-viewer/geometry-engine build — Passed.
• pnpm --filter @file-viewer/renderer-3d build — Passed.
• pnpm --filter @file-viewer/renderer-3d verify:ifc — Passed, including six settings tests against the real upstream importer.
• pnpm --filter @file-viewer/renderer-3d verify:ifc-browser /tmp/ifc-samples — Passed with original models, real Worker settings, picking, late hooks, failure cleanup and reentrant disposal.
• pnpm --filter @file-viewer/thumbnail test — Passed in dependency qualification.
• node --test tests/ifc-settings.test.mjs — Passed against actual cold-installed tarballs.
• node tests/verify-ifc-browser.mjs /tmp/ifc-samples — Passed against the cold-installed distribution and its generated Workers, using unchanged assertions.

Qualification evidence:

Check	Successful run
Coordinated dependencies, clean Angular install/peers/compilation	https://github.com/flyfish-dev/file-viewer/actions/runs/34679652404
Advanced configuration and pre-model cancellation	https://github.com/flyfish-dev/file-viewer/actions/runs/34680261413
Reentrant teardown: required baseline failure, then same assertions passing	https://github.com/flyfish-dev/file-viewer/actions/runs/34680829005
Final exact-head tarballs: export, declarations, installed CLI, real browser/Workers	https://github.com/flyfish-dev/file-viewer/actions/runs/34680956125

Final-head Public CI: https://github.com/flyfish-dev/file-viewer/actions/runs/34680927047.
Final-head Security: https://github.com/flyfish-dev/file-viewer/actions/runs/34680927058.
These and the latest PR Governance must all complete successfully before merge. Older heads' checks do not substitute for the current head.

Cold installation used the real core, geometry-engine and renderer-3d tarballs with pinned optional peers, without bundler aliases or dependency overrides. The installed asset command generated the actual WASM and both Workers. Package hashes, asset manifest and browser reports are retained in the qualification artifacts.

The lockfile was regenerated and frozen reinstallation passed with identical bytes: Vitest was already overridden and the Angular fixture is outside the workspace. Failed baseline tests are intentionally retained as failure-before-fix evidence, not counted as successful product gates.

Sample / fixture evidence

Unmodified official buildingSMART IFC4 and IFC4.3 source at a pinned revision:
https://github.com/buildingSMART/Certification-datasets/tree/80d976a9b193a26a8e928c3e79bff67af1de68a8

Downloader, fixture paths and SHA-256 checks:
https://github.com/flyfish-dev/file-viewer/blob/5a37e3b2132cd1afdfda8a9f9605cc51f44ade87/packages/renderers/3d/scripts/download-ifc-fixtures.mjs

Actual browser evidence and reproduction guide:
https://github.com/flyfish-dev/file-viewer/tree/5a37e3b2132cd1afdfda8a9f9605cc51f44ade87/docs/regressions/issue-267/advanced

Both ordinary fixtures retain 13 geometric items and 1,143 triangles. Importer Name exclusion changes real selected model data; the actual Fragments instance applies maxUpdateRate: 80. Every tested teardown reaches zero tracked Workers. CC BY 4.0 attribution remains in IFC.md.

Visual evidence

Default scene geometry remains unchanged from the qualified #276 foundation. The advanced test changes selected properties, not the default visual design.

Risk and compatibility

Affected packages/formats: optional renderer-3d IFC entry/importer Worker, nested Angular consumer fixture and thumbnail test tooling. Ordinary Office/3D entries, default settings and runtime dependency count remain unchanged.

Compatibility or migration risk: advanced settings are upstream-version-coupled public data, not executable document metadata. Existing post-load configure remains supported. Hooks may be async and return synchronous host-resource cleanup; reverse-order cleanup runs once, including late completion after cancellation. Do not dispose adapter-owned objects or replace Worker/lifecycle methods. Configuration bounds are not validation of every upstream numeric option. Self-hosting consumers must regenerate/deploy the matching importer Worker when updating the adapter.

Rollback: revert this consolidated squash commit and regenerate IFC assets from the previous adapter. Revert the Angular cohort together. No user-file or persisted-data migration is introduced.

Release handoff: published DOCX was still 0.3.31 at review. After publishing the merged upstream fix, run pnpm release:prepare-docx <exact-published-version> and pnpm release:verify; review and commit synchronized dependency/Worker/lock metadata before File Viewer publication. Green source CI is not evidence that a future upstream npm version exists.

docs/maintenance/pr-issue-review-20260912.md records all seven open issues: #227/#248/#269 need original artifacts, #266/#268 await package delivery/acceptance, #267 is optional visual inspection rather than BIM authoring, and #277 is a separately scoped proposal. No issue closes automatically.

Checklist

• All six starting PRs and seven issues were reviewed with disposition recorded.
• Contributor direction is credited without introducing a duplicate draft runtime.
• Actual upstream settings and failure-before-fix lifecycle regressions are tested.
• Final-head real tarballs and installed Workers pass the same browser assertions.
• Angular framework/tooling are coordinated and clean-install compiled.
• Dependency grouping and consistency guards prevent recurring split upgrades.
• No private fixtures, secrets, transfer payloads or temporary workflows are included.
• No publication, tag or automatic issue closure is included.