fix(deps): preserve chart hover and React version compatibility

[wybaby168]

Summary

• Preserve the tooltip and visible hover focus line with Billboard 4's modular ESM entry. The grid module is registered when the supplied chart library exports it.
• Update Billboard to the normal ^4.1.0 range, JSDOM test dependencies to 30.1.2, and modern React packages to React 19 types. Both React 17 legacy packages retain React 17 types.
• Make the chart regression fixture self-contained and preserve 4gray's original PR fix(text): decode Latin-1 and other single-byte txt files instead of GB18030 #326 image with attribution and its exact original bytes.
• Keep validation checks running while Actions storage is full: emit bounded JSON reports and proof-file identities in job logs, with package caches disabled in the four validation workflows.

Related issue

N/A: coordinated dependency maintenance. This implements the updates proposed in #315, #316 and #319 with compatibility fixes, and preserves the unique visual contribution from #326.

Change classification

• User-visible UI or rendering change
• Non-visual change
• File-format or renderer behavior
• Public API, package, Worker, WASM, or deployment-path change

Verification

All checks below completed locally on Node 26.8.2 and pnpm 11.0.9. The normal frozen install used a new independent dependency directory, store and metadata cache; the lockfile did not change.

Check	Result
pnpm install --frozen-lockfile with fresh task store/cache	Pass, 98 workspace projects
pnpm build	Pass, canonical complete workspace build
pnpm type-check	Pass, including modern and legacy React components
pnpm test	Pass, including 202 Vitest cases and 165 text-encoding groups in each of Chromium and WebKit
pnpm verify:github-governance	Pass, 109 tests; one expected public-boundary skip
pnpm --filter @file-viewer/pptx verify:chart-families	Pass, 25 actual browser checks plus two metadata checks

The two real hover-focus checks fail before the renderer fix. After the fix, the browser checks pass at DPR 1 and 2 with no external requests or uncaught browser errors. Public CI now runs this chart gate after the existing issue regressions.

Sample / fixture evidence

• Repository chart fixture generator generates the small three-slide OOXML presentation used by the actual parser, Worker and chart library.
• packages/renderers/text/test/single-byte-encodings/fixtures.mjs supplies the existing bounded text fixtures and exact search-offset checks.
• docs/regressions/text-single-byte-encodings/original-before-after.png preserves the original public image from 4gray's PR fix(text): decode Latin-1 and other single-byte txt files instead of GB18030 #326, commit b957c2be56e753a05889fbb3828e950cc4277d1d.

Visual evidence

After a real mouse hover on the stacked chart:

The generated doughnut retains its 75 percent hole ratio:

Risk and compatibility

• Affected packages/formats: PPTX chart capability/renderer, text and Word development tests, modern React types, and the four validation workflows.
• Compatibility or migration risk: JSDOM 30 requires development-time Node ^22.22.2 || ^24.15.0 || >=26.0.0. Public CI uses Node 24; consumer runtime requirements remain unchanged.
• The optional grid registration also supports custom or bundled chart loaders. The legacy React 17 dependency cohort remains intact.
• Validation logs retain small JSON results and SHA-256/size identities for selected proof files. Raw screenshots remain on the runner during the job; the representative images above are committed. Existing release uploads and stored Actions artifacts remain in place.
• Package-wide distribution and default optional-capability security qualification remain release gates.
• Rollback: ordinary revert of these two commits and their generated lockfile update.

Checklist

• I added or updated focused automated coverage, or explained why it is not needed.
• I updated user-facing documentation or release notes when behavior or API changed, or marked them not applicable.
• I verified offline/private-deployment paths when changing Worker, WASM, fonts, vendor assets, or URLs.
• I did not commit secrets, customer files, private samples, generated caches, or unrelated changes.