fix(ppt): stage published runtime and validate Angular consumers

[wybaby168]

Summary

• Resolve @file-viewer/ppt 0.3.6 as an ordinary registry dependency and stage its verified runtime during normal Demo, WebFull and copy-assets builds. A stale 0.3.4 bootstrap can no longer replace the installed runtime in generated packages.
• Remove the temporary PPT patch and cold-consumer repacking path. Verify the official archive SHA512, complete file inventory and installed byte identity; retain strict version, native/font hashes, size and license gates.
• Upgrade all seven Angular fixture packages to 22.2.1 and run the packed PPTX consumer in Chromium and WebKit, including real ApplicationRef destruction and Worker termination before closing the page.

Related issue

Related to #329. Covers the Angular fixture update proposed in #328; disposition of that PR follows actual landing of this replacement.

Change classification

• User-visible UI or rendering change
• Non-visual change
• File-format or renderer behavior
• Public API, package, Worker, WASM, or deployment-path change

Verification

Check	Result
pnpm install --frozen-lockfile	Pass: independent checkout, ordinary unpatched PPT 0.3.6
pnpm build	Pass: complete normal build, all four PPT asset trees match the official installed runtime
pnpm type-check	Pass: all owning packages and Demo
pnpm test	Pass: complete canonical suite, including Chromium and WebKit encoding regressions
pnpm verify:github-governance	Pass: 109 passed, one expected skip; formatting passed
node --test packages/components/web-full/test/asset-manifest.test.mjs	Pass: 10 tests, including stale bootstrap replacement and installed version/hash rejection
pnpm exec vitest run test/copied-assets.spec.ts test/presentation-renderer.spec.ts test/presentation-lifecycle.spec.ts test/pptx-generated-style-regression.spec.ts test/pptx-worker-resolution.spec.ts	Pass: five files, 41 tests
node .github/scripts/verify-ppt-distribution.mjs	Pass: official registry 0.3.6 SHA512 and all 11 distribution files match
node apps/component-demo/scripts/verify-packed-issue-closure.mjs	Pass: fresh normal packing/install, 21 Webpack cases; Angular 22.2.1 Chromium four cases and WebKit four cases
pnpm docs:build	Pass: complete canonical production build from fresh output; earlier sandbox-error output retained

Each positive Angular case rendered all 20 slides, started one real Worker and closed it after application destruction. Both missing-manifest cases produced handled diagnostics without a guessed Worker request. Angular full/production audits are zero; the existing Webpack development cohort reports 32 affected entries and 18 distinct advisories, with production scope zero.

Sample / fixture evidence

• apps/viewer-demo/public/example/office-demo.ppt: normal published PPT 0.3.6 cold preview, 25 pages.
• apps/viewer-demo/public/example/ppt.pptx: Angular fixture copies this public sample into the fresh consumer and checks 20 slides.
• packages/components/web-full/test/asset-manifest.test.mjs: bounded synthetic assets test stale copies, native byte tampering and incompatible installed versions.

Visual evidence

N/A: this maintenance change corrects package ownership and build asset selection and extends the consumer/lifecycle verification matrix. It adds no UI styling or layout changes; the real browser tests assert existing PPT/PPTX pages and Worker behavior.

Risk and compatibility

• Affected packages/formats: the PPT renderer, bundled WebFull, copy-assets and Demo output, plus the Angular regression fixture.

• Compatibility or migration risk: these PPT builds now require the exact official 0.3.6 runtime. Builds fail on missing or corrupt installed runtime rather than publishing stale bootstrap bytes. Copied workers, WASM, font and license assets stay local and byte-identical; production Angular /ui/ deployments and development restart paths pass in both browsers. Angular 22.2.1 is confined to the regression consumer fixture.

• Rollback: use an ordinary source revert and normal rebuild of matching dependency, lockfile and assets. This PR does not qualify the new native cohorts in chore(deps): qualify native runtimes and IFC selection completion #361 or freeze/publish the aggregate release; those retain their separate source, license, security and browser gates.

Checklist

• I added focused asset integrity and published-engine candidate coverage and exercised the actual Angular disposal/browser matrix.
• I updated the public PPT dependency/version facts in the existing documentation and Demo sample metadata.
• I verified local Worker/WASM/font asset copies and packed production /ui/ and development consumer paths without runtime CDN fallback.
• I did not commit secrets, customer files, private samples, generated caches, or unrelated changes.