chore(release): publish 3.1.0 public boundary

[wybaby168]

Summary

• Projects the frozen 3.1.0 source commit 893dca367bb8ecf4944ad9b60bab2ddc58510e4c onto the public repository.
• Retains the existing chore(release): publish 3.1.0 public boundary #288 commit history and adds a 15-file follow-up from the verified closure.
• Makes the PDF renderer own its CJK fallback font and turns incomplete asset installs into actionable repair failures.

Related issue

Related: #232, #242

Change classification

• User-visible UI or rendering change
• Non-visual change
• File-format or renderer behavior
• Public API, package, Worker, WASM, or deployment-path change

Verification

Check	Result
node scripts/run-standard-release-rehearsal.mjs --fresh	Passed: 91 frozen tarballs, four package managers, eight browser runtime checks, including Vue 2.6.
node scripts/sync-public-main.mjs --skip-build --stage	Passed: frozen receipt, DICOM ledger, signature licenses, governance formatting, source index, and staged-diff checks.

Sample / fixture evidence

• Repository fixtures: apps/viewer-demo/public/example/sample.eml and apps/viewer-demo/public/example/pdf.pdf; complete, missing, and partial PDF CJK font sources are covered by packages/presets/vite-plugin/scripts/verify-github-242.mjs.

Visual evidence

• N/A: this changes runtime dependency ownership and asset-copy validation, not demo layout or component styling.

Risk and compatibility

• Affected packages/formats: @file-viewer/renderer-pdf, Vite asset copying, EML parsing, and all framework wrappers including Vue 2.6 and 2.7.
• Compatibility or migration risk: PDF consumers now receive the required CJK fallback through the renderer dependency; incomplete installs fail with a repair action instead of silently degrading output.
• Rollback: revert this public follow-up commit and republish only after a new frozen closure proves the replacement bytes.

Checklist

• I added or updated focused automated coverage, or explained why it is not needed.
• I updated user-facing documentation or release notes when behavior or API changed, or marked them not applicable.
• I verified offline/private-deployment paths when changing Worker, WASM, fonts, vendor assets, or URLs.
• I did not commit secrets, customer files, private samples, generated caches, or unrelated changes.