feat(canvas): coordinate DOM input with React commits

[developer-1px]

Summary

• add a render-aware external-change host that requires the current immutable DesignDocument and EditorEngine snapshot identities to be acknowledged by one canonical React renderer lease
• preserve the existing ReactDesignEditorRuntime shape and expose coordination through additive renderer, host getter, and text-selection exports
• restore native text-control selection through stable node ids and UTF-16 offsets while rejecting stale ownership, redirected focus, deliberate blur, and unsupported remounts
• keep FigJam composition-owned blur pending through a restartable 30 ms settling window so a later-task final input updates the preview before commit
• record the browser coordination contract in ADR 0007 and add a Chromium causal/render/selection tracer

Ordering

Input preview → local canonical commit → local React DOM commit acknowledgement → ready external apply → external React DOM commit acknowledgement → selection correction.

The layout effect is the render evidence. Microtasks only deliver retry notifications. Duplicate canonical renderers fail closed for the runtime lifetime because DomProjection has singular node registration.

Boundaries

• no existing Canvas or json-document API is changed; the new public exports are additive
• this does not choose CRDT, OT, transport, retry, persistence, or convergence policy
• selection currently preserves and clamps native text-control UTF-16 offsets; it does not rebase a caret through same-node text patches
• the 30 ms composition settling window is conservative browser coordination, not proof of native Korean/Japanese IME behavior across operating systems and Safari

Validation

• focused runtime, selection, IME, package-surface, and architecture tests: 43 passed
• Canvas document and architecture scope: 295 passed with two workers
• full isolated Chromium E2E suite: 126 passed; final causal/IME tracer rerun: 2 passed
• package and app TypeScript checks
• focused ESLint
• package build and smoke test
• Vite production build
• three independent host, selection/IME, and compatibility reviews with no remaining blocker

The default-parallel release check completed package build/smoke but hit the existing 5-second timeout in CanvasModuleBoundaries file-scanning tests. The identical 70-file, 295-test scope passes with maxWorkers=2. The unrestricted full Vitest suite also retains the pre-existing CanvasDemoDesignSystem spacing-token failure for the unchanged FigmaCloneApp.css margin declaration.