Add explicit review and comment export profiles

[JSv4]

Closes #444

Summary

• Add explicit final, original, and markup review profiles plus hidden, inline, endnotes, and margin comment profiles across the browser API, Node API, CLI, worker, and WASM bridge.
• Preserve revision authorship/dates and comment bodies, ranges, replies, authors, dates, and resolution status while keeping source package bytes immutable.
• Inventory auxiliary revision stories for export diagnostics, including comments, glossary, and styles, without broadening the historical mutation API.
• Fail closed or warn deterministically for unsupported revision families, malformed/ambiguous comment topology, missing fragment targets, and clipped margin threads.
• De-duplicate comment definitions and targets cloned through repeated headers/footers.
• Align the projection path with the corrected Add deterministic OOXML package manifests #493 behavior already present in this stack.

Verification

• Full .NET suite: 3,864 passed, 3 skipped
• Focused review/projection/HTML suite: 81 passed
• Chromium review/pagination/print/export suite: 27 passed
• Node/CLI/Chromium/PDF exporter suite: 22 passed
• Generated-PDF fidelity ratchet: 10/10 cases passed; semantics and geometry passed
• Production WASM build: 3.38 MB Brotli / 4 MB budget
• Package boundary: 175 runtime/license files

Viewable evidence

CI uploads playwright-report even if a later test fails. It now contains both npm/test-artifacts/ and npm-export/test-artifacts/.

Local viewers from the final run:

• npm/test-artifacts/review-comment-profiles/index.html — all 12 browser profile combinations
• npm-export/test-artifacts/view-artifacts.html — Node/PDF matrix plus warn/strict/fail-closed evidence
• /tmp/docxodus-444-release-artifacts-2/index.html — complete generated-PDF ratchet evidence

[JSv4]

Follow-up f3fda3d closes the #465 integration edge discovered after #493 landed:

• adds reviewProfileAlreadyApplied for exact final/original packages across browser, worker, Node, framed host, CLI, schema, and docs;
• inventories the supplied package and fails closed if any tracked revision remains;
• preserves the caller's exact bytes/digest and omits derivedProfileSource;
• rejects the declaration for markup and leaves default profile behavior unchanged.

Verification:

• browser review/comment suite: 4/4 (including the 12-profile matrix)
• Node/CLI/framed-host suite: 23/23
• browser and Node typechecks: pass
• browser package boundary: 175 files; Node package boundary: 51 files

New viewable evidence is generated at npm/test-artifacts/profile-resolved-sources/index.html and npm-export/test-artifacts/success/profile-resolved-sources/index.html; both live under the paths already uploaded by CI.

[JSv4]

Closing as part of retiring the #505 → #506 → #507 → #508 stack — see the rationale on #505. The stack forked before #493/#500/#501 landed and re-adds merged work; this tip is also conflicted against its base.

#444 is being redone against main as the last of four serial PRs. It is the smallest of the four in real terms: --review-profile / --comments are already wired end-to-end on main — handleProjectReviewProfile routes to AcceptRevisions/RejectRevisions, and commentProfile maps to CommentRenderMode.{Disabled,Inline,EndnoteStyle,Margin} in npm/src/export-browser.ts. What remains is hardening, not plumbing: unsupported-family warnings, comment-topology validation, dedup of definitions cloned through repeated headers/footers, and margin-thread clipping. The branch is kept as the archive of record.

Per #437's design doc, #443 only becomes the release gate once this has landed, so a reviewed ratchet refresh for the comment-bearing fixtures is budgeted into it.

---

Generated by Claude Code