Harden parser, renderer, and input pipelines

[dsafdsaf132]

Summary

• Bound Gerber step-and-repeat, polygon, aperture-macro, and generated-region workloads before expansion.
• Enforce remote download, ZIP expansion, repeat, and layer limits while making upload cleanup reliable.
• Make framebuffer, shader, and context-restoration resource replacement transactional.
• Abort failed browser PNG streams while preserving the original export error.
• Pin Rust and wasm-pack versions, expand JavaScript and Rust quality gates, validate rendered PNG pixels, and add macOS x64 build-only compatibility coverage.
• Update renderer platform and streaming documentation in every maintained language.

Why

The project review identified resource-exhaustion paths for untrusted files, partial WebGL state after allocation failures, incomplete browser stream cleanup, and CI checks that could miss blank renderer output or overstate platform validation.

Impact

Malformed or highly amplified inputs now fail with bounded errors instead of consuming unbounded browser or WASM resources. Renderer recovery leaves the previous state intact until replacement resources are complete. Browser exports close on success and abort on failure.

The compatibility matrix runs native context and renderer smoke tests on Linux x64/arm64, macOS arm64, and Windows x64/arm64. macOS x64 validates installation and native module loading only because the GitHub-hosted Intel runner cannot create an ANGLE EGL display.

Validation

• cargo test --manifest-path wasm/Cargo.toml --all-targets: 161 passed
• cargo fmt --manifest-path wasm/Cargo.toml --all -- --check
• cargo clippy --manifest-path wasm/Cargo.toml --all-targets -- -D warnings
• npm run check in packages/wasm-gerber-renderer: 34 passed
• ./scripts/vercel-build.sh with Rust 1.97.0 and wasm-pack 0.14.0
• npm pack --dry-run: 15 package files
• Recursive JavaScript syntax and workflow YAML validation
• Drill smoke fixture parsed through the generated WASM package

Remaining validation

The updated native compatibility matrix will run on this pull request. Direct mock-based WebGL allocation failure injection remains a future testability improvement because the renderer currently owns a concrete web_sys::WebGl2RenderingContext.