fix(data-integrity): keep controlled value sync atomic

[seonghobae]

Closes #200.
Closes #252.
Closes #263.
Closes #267.
Closes #271.

Scope

Draft standalone CwlEditor integrity lane. This remains the active Inkspan source writer for src/components/CwlEditor.tsx; stacked browser assurance remains in Draft #380.

Dependency stack

This source-owner PR inherits the shared dependency foundation from #402 through the Markdown owner #176 by ordinary merge history. Its base is the #176 branch fix/public-markdown-resource-options-175; #380 remains its browser-only child. The net delta against #176 remains standalone controlled-editor semantics and their regression tests. The merge preserves the local preview/rollback and composition lifecycle instead of replacing them with a direct document swap. The helper uses TipTap 3's explicit update-suppression options and public core Editor type; existing behavior and packed-declaration checks reproduced both migration regressions before repair.

Behavior contracts

• runtime editable and toolbar visibility inputs fail closed on invalid runtime types;
• controlled/source/reset document inputs accept only the documented string/undefined forms;
• controlled replacement remains transaction-atomic and refuses rejected/transformed previews;
• revoking editability during active composition drains the local composition before read-only transition;
• a controlled value received during composition is deferred and the latest host value is applied after composition ends;
• intermediate composition edits may update the legacy onChange value stream but are excluded from strong onDocumentChange snapshot callbacks until composition is no longer active.

Composition lifecycle tracking is installed synchronously from TipTap onCreate onto the created editor view's DOM before the public onReady callback runs, and is removed during TipTap onDestroy. This keeps lifecycle ownership on TipTap creation/destruction rather than a callback-sensitive React effect while making the immediate-post-ready composition boundary executable.

These are standalone editor/document semantics only. This PR adds no transport, authentication, tenancy, durable persistence, credentials, migrations, retention, deployment, durable audit, model/provider, network, durable PDF, or host-owned Yjs authority.

Verification discipline

The realistic composition regression is src/components/CwlEditor.controlledValueComposition.test.tsx; it exercises a composition that starts immediately after editor readiness, performs an intermediate document change, and requires the strong snapshot callback to remain silent until composition ends. Do not weaken or replace that regression to obtain a green run.

Do not embed mutable PR-head SHAs, protected-main SHAs, workflow run IDs, review counts, mergeability snapshots, or child-stack heads in this body as durable truth. Before any lifecycle action, independently refetch:

• exact protected main and this PR's exact current head/live base;
• ancestry, mergeability, changed paths, and active writers;
• formal reviews and unresolved threads;
• every applicable repository and central workflow/job, including actual checkout/source identity and skipped-required-step state;
• live rulesets/protection and release-acceptance state from release: reconcile Office and npm versions before next stable registry publication #118;
• current test(input): add multilingual browser input baseline #380 parent/child ancestry before any stacked-PR action.

Pending, queued, skipped-required, cancelled, absent, neutral, failed, stale, predecessor, status-only, synthetic-source, wrong-checkout, model-only, or otherwise vacuous evidence is non-passing. Repository CI success is technical evidence only and does not substitute for qualifying independent approval or correct central security/review workflows.

Ownership / governance boundary

Keep this PR Draft until its behavior and exact-current evidence satisfy then-live governance. Draft #380 owns browser harness/spec/config evidence only and must not re-own this PR's production source. Central reusable workflow defects belong to their existing .github owner paths, not to an Inkspan-local workaround.

Do not mark Ready, merge, tag, publish, transfer predecessor evidence, self-approve, weaken gates, create a competing source/workflow writer, force-push/destructively rebase, or fabricate release identity. Protected shipped truth remains whatever exact main resolves to at decision time; #118 remains the canonical stable-release operational-acceptance boundary.