fix(figma): persist local projects across plugin restarts

[Jan-CoreBunch]

What

Local Figma projects now survive closing and reopening the plugin, including the bundled starting presets and larger custom projects. Local saves report success only after project persistence and variable synchronization complete, and synchronization leaves variables in other collections untouched.

Why

The default project JSON exceeds Figma's 100 kB per-entry plugin-data limit. The old flow could update Figma variables while project storage failed, then show success after a fixed 200 ms delay. Reopening offered a new project instead of the saved one.

• Store projects in small chunks and publish their metadata only after every chunk is written. A failed storage write preserves the previous complete save; legacy single-entry projects remain readable.
• Correlate local-save requests and acknowledgements, report failures/timeouts, and display unreadable-project errors before users replace saved data.
• Restrict variable updates and deletion to the Core Framework collection, including when another collection has the same variable name.
• Add regression coverage and document local-project reopening. The project schema, CSS generation, and WordPress transport remain unchanged.
• Pin existing build-tool dependencies to shell-quote 1.11.0 and proxy-addr 2.0.8 to clear the critical audit failures already present in the base lockfile (shell-quote advisory, proxy-addr advisory). These are the only dependency resolution changes; regenerating the lockfile also refreshes workspace version metadata to the existing 2.0.2 manifests.

Verification

• Dependency follow-up, using CI's Bun 1.3.11: frozen-lockfile installation and bun audit --audit-level=critical passed; all 34 Figma tests and both bun run build:figma and bun run build:blocks passed. The audit policy is unchanged.
• Figma: bun test ./tests from packages/figma — 34 passed, including oversized presets, Unicode, legacy migration, failed writes, acknowledgements, and collection isolation.
• Web: node ../../node_modules/jest/bin/jest.js --runInBand --coverage=false --watchman=false from packages/www — 26 suites / 162 tests passed.
• bun run build:www and bun run build:figma passed; Figma type checking, Biome checks on the relevant TypeScript files, and git diff --check passed.
• Built Figma main bundle saved and reopened a 250 kB project in a minimal sandbox without browser encoding/storage APIs. Figma output boundary scan passed.
• Reviewed existing Figma fixes, including host-message routing and WordPress synchronization. PR fix(figma): stop stuck saves and sync prefixed names to builders #39 applies cleanly; its hook changes combined with this fix passed 13 tests across 3 suites in an isolated fixture.
• User verified both local and WordPress workflows in Figma: adding, updating, deleting, saving, and reopening retained the expected variables. A separate collection containing a same-named secondary color with a different value was unaffected.

The source boundary scan encounters an existing Windows path-separator issue in the allowlist for packages/wp/wp/Config/Setup.php. The read-only scan passes when paths are normalized in memory; neither the scanner nor that PHP file was changed. Generated builds and local compatibility fixtures are excluded from this PR.