fix(publish): address PR #232 review (16 findings)

[tsenoner]

Addresses every Critical, Important, Minor, and test-coverage finding from the /review of PR #232.

What's fixed

Critical

• Plot-cache key now includes background color (white ↔ transparent toggles invalidate)
• Inset render fast-path bypassed during export (no preview-resolution downgrades)
• _setupOverlay guarded against post-disconnect resolution (no leaked listeners)

Important

• pngWithDpi validates PNG signature and chunk-length bounds; warns on malformed input
• sanitizeNormRect clamps slack overrun instead of leaking past [0,1]
• Label text capped at 256 chars (localStorage quota DoS guard)
• publishState sanitized at the parquet ingest boundary (injectable sanitizer keeps utils → core boundary clean)
• _applyPreset derives sizeMode from preset width
• DRY: 25.4 literals replaced with pxToMm/adjustDpiForWidthMm
• Dead first pass in legend Y-offset removed
• capturePlotCanvas fallback passes full source pixel rect (no HiDPI halving)
• composeFigure null-checks 2D context (soft fail instead of crash)
• Modal stays open on export failure (state already persisted; user can retry)

Test coverage

• CRC32 cross-validated against an independent reference implementation
• Prototype-pollution + deeply-nested payloads covered in state validator
• Rotated and zero-size overlay hit-testing
• Fingerprint stale-warn DOM rendering
• E2E click-to-Export + verify pHYs ppm in downloaded PNG
• Three tautological export-utils suites dropped (no behavior, just JS-operator identity)

Plus a baseline knip entry registration (perf/**/*.spec.ts) so precommit passes.

Plan: docs/superpowers/plans/2026-05-05-publish-editor-review-fixes.md.