chore(deps): consolidate reviewed updates and repair peer and license gates

[brownie-cake]

Summary

Finish the dependency review after merged #278. Consolidate #279, #280, #282, #283 and #284 into one tested dependency tree instead of merging divergent lockfiles. Defer #285's incomplete Vitest 5 migration; retain the actual verified Vitest 4.1.11 toolchain. No package version bump, tag, npm publication or automatic issue closure.

• Adopt the reviewed grouped dependency updates, Buffer 6.0.3 / assert 2.1.0 browser shims, and Angular CLI/build 22.1.7 with framework/compiler 22.1.6.
• Correct the overly strict Angular guard: framework/compiler exact peers stay aligned, CLI/build stay aligned, and the two groups share a release line without falsely requiring the same independent patch number. Negative consistency tests remain enforced.
• Add a permanent regression for the actual shipped Avro browser bundle and its Blob decoder, including Unicode/binary records, null/deflate codecs, empty containers, malformed magic and Node-global isolation.
• Regenerate both impacted license ledgers from installed dependencies, without weakening license policy, audit thresholds or exceptions.
• Adopt pinned pnpm/action-setup 6.1.0 and upload-artifact 7.0.1; both have executed in qualification, with a successful artifact upload/download round trip.
• Correct the packed Angular browser report to read actual installed framework/build/CLI versions rather than reporting the hardcoded old 22.0.7 value.

Related issue

Refs #267, #266 and #268. Supersedes the upgrade proposals in #279, #280, #282, #283 and #284 only after this consolidation passes its final checks and merges. The original PR commits are not represented as merged.

#285 is explicitly deferred: declaration-only Vitest 5 changes cannot qualify a new runner while the workspace override still installs 4.1.11. A future major migration must update the override, configuration and full test matrix together.

Change classification

• Non-visual change
• User-visible UI or rendering change
• File-format or renderer behavior
• Public API, package, Worker, WASM, or deployment-path change

Verification

Final review head: 8128d57873bcfaf409f91ab0ad20efd7714b2c36.

The dependency source commit e0be5dac4f7c3edcfd9d71d1b14d12a905fc851a was qualified before pushing in https://github.com/flyfish-dev/file-viewer/actions/runs/34685836777. The final head additionally wires the same successful Avro check into CI, updates tested Action pins, records review decisions and corrects Angular version reporting. Full Public CI, Security and PR Governance must pass on this final head before merge.

• pnpm install --lockfile-only --ignore-scripts and pnpm install --frozen-lockfile — Passed for the integrated dependency tree.
• pnpm verify:github-governance and pnpm verify:public-release-facts — Passed in qualification; rerun on the final PR head.
• pnpm audit --registry=https://registry.npmjs.org --audit-level=low — Passed under the unchanged, bounded existing exceptions. Two existing ignored advisories remain (one low, one moderate); this is not a claim of zero advisories.
• pnpm verify:dicom-license-ledger --write followed by strict pnpm verify:dicom-license-ledger — Passed.
• pnpm --filter @file-viewer/renderer-signature generate:licenses followed by strict verify:licenses — Passed.
• Core, geometry, renderer-3d, renderer-data and thumbnail builds — Passed.
• pnpm --filter @file-viewer/thumbnail test — Passed.
• pnpm --filter @file-viewer/renderer-3d verify:ifc and verify:ifc-browser /tmp/ifc-samples — Passed; original IFC4/4.3, actual settings, picking, cancellation, late/throwing cleanup, reentrant teardown and zero remaining Workers.
• pnpm --filter @file-viewer/renderer-data verify:avro-browser — Passed; 37 exact records for each null/deflate codec, empty containers, invalid magic, zero HTTP requests/page errors and no leaked Buffer/process/require globals.
• Fresh Angular npm install (without force or legacy-peer bypass), npm ls framework/compiler/tooling and ng build — Passed with framework/compiler 22.1.6 and CLI/build 22.1.7.

The original grouped PR's Security job failed on a stale DICOM ledger. This integration also found and corrected signature ledger drift caused by JSZip/pako updates. It does not turn off those checks. The pre-fix Angular guard was explicitly reproduced rejecting the valid independently patched tooling before its correction.

Sample / fixture evidence

Actual Avro browser fixture generator and assertions:
https://github.com/flyfish-dev/file-viewer/blob/8128d57873bcfaf409f91ab0ad20efd7714b2c36/packages/renderers/data/scripts/verify-avro-browser.mjs

Official IFC4/IFC4.3 fixture provenance and SHA-256 gate:
https://github.com/flyfish-dev/file-viewer/blob/8128d57873bcfaf409f91ab0ad20efd7714b2c36/packages/renderers/3d/scripts/download-ifc-fixtures.mjs

The unmodified buildingSMART fixtures retain their attribution and pinned source revision. The qualification run linked above contains actual Avro/IFC JSON results, Angular peer/build logs, the exact patch, source commit and audit output. No private sample was added.

Visual evidence

N/A: this change preserves the existing viewer interface and expected decoded output. It updates dependencies, generated license metadata and regression/evidence correctness rather than introducing new visual behavior. Actual browser IFC/Avro output is asserted; earlier IFC screenshots remain in the merged #276/#278 regression reports.

Risk and compatibility

Affected packages/formats: the reviewed workspace dependency closure, data renderer Avro browser bundle, optional IFC renderer dependencies, Angular cold-consumer test tooling, DICOM/signature license metadata and CI Actions.

Compatibility or migration risk: Buffer/assert are declared as build dependencies but are bundled into runtime Avro code, hence the mandatory real-browser gate. Angular framework packages still require exact matching peers; only the independently released CLI/build patch group is allowed to differ on the same reviewed release line. The actual npm peer tree is checked without override workarounds. Existing public viewer APIs and application deployment paths are unchanged. Vitest stays on the currently verified 4.1.11 runner.

License changes are generated and narrow: DICOM baseline-browser-mapping 2.11.19 to 2.11.22; signature JSZip 3.10.1 to 3.10.2 and its pako 1.0.2 to 1.0.11, with actual MIT/Zlib license text and hashes. Security workflow policy and dependency-review allowlist are unchanged; only its setup action pin changes.

Rollback: revert this consolidated squash commit and restore the lockfile plus generated ledgers together. Regenerate distributable bundles from restored dependencies; do not roll back only one member of a framework/compiler peer group. No user-file or persistent-data migration is introduced.

Release handoff remains explicit: the registry still exposed @file-viewer/docx@0.3.31 at review. After the maintainer publishes the already merged upstream fix, run pnpm release:prepare-docx <exact-published-version> and pnpm release:verify, then review and commit synchronized dependency/Worker/lock metadata before publishing File Viewer. Source CI success does not mean that future upstream package is already published.

The seven current issues were re-read individually with comments. #227/#248/#269 still lack original reproductions; #266/#268 have source fixes pending package delivery/acceptance; #267's optional inspection scope is implemented; #277 remains a separate feature proposal. None is silently marked fixed by unrelated synthetic tests or closed automatically.

Checklist

• Every new dependency PR has an explicit adopt/consolidate/defer decision.
• The integrated dependency tree was frozen, built and browser-tested before its source push.
• Angular constraints follow verified peer metadata rather than patch-number coincidence.
• Both license ledgers were regenerated and strictly checked; no audit policy was weakened.
• Runtime-affecting browser shims have an actual shipped-bundle regression, now enforced in CI.
• No private fixtures, secrets, transfer payloads or temporary maintenance workflows are included.
• No npm publication, version bump, tag or automatic issue closure is included.