feat: add embeddable HTML document output

[rponeawa]

Embedded previews need a buildable HTML document with playback controlled by the host. This adds @hypit/html-document with a page:Document node, selected in SVRun through <target output="preview.document"/>.

The result preserves picture, audio and material references. Hosts materialize it with their own asset URLs and embed the generated HTML in an iframe. The document exposes playback, frame seeking and mute controls through JavaScript and a parent-window message API, allowing the host to supply its own controls.

Shared browser playback lives in @hypit/html-program/playback. Studio assembles its own preview from Composition and Timeline and imports this player. html-document uses it when materializing its output document. Existing SVML projects keep their imports and preview through Studio as before. @hypit/video includes the document package in its default dependencies.

HypiHub draft PR #53 uses this output for queued marketplace previews. The execution-worker idle-retention change has been withdrawn from this PR.

Validation

• pnpm check passed after withdrawing the Runtime changes.
• 130 existing Runtime configuration/worker, Studio and HTML Program tests passed.
• With the restored Runtime package, three consecutive Ranking builds and one caption build produced HTML documents successfully.
• Removed regex-based script extraction flagged by CodeQL for excessive runtime and incomplete tag matching. Script nodes are collected with the linkedom HTML parser and initialized after font loading and the first layout frame, allowing CSS animations to materialize. Complete HypiHub pages verified both Ranking and caption playback; uploaded Ranking images also rendered successfully. GitHub CodeQL passed with both alerts marked fixed. Type checking and 109 existing Studio/HTML Program tests passed, and fresh Ranking/caption artifacts passed browser playback, frame 50 seeking and resume checks.
• Earlier local package and browser checks verified Ranking and caption document output, fonts, pause, frame seeking, resume, drag-to-seek and Apply, including administrator previews.

Release preparation

Package versions are unchanged. Changed existing packages need unpublished versions before release. Production services and npm publication were untouched.