feat(signature): add optional CMS and timestamp renderer

[p4535992]

Summary

• Adds the contributor-built @file-viewer/renderer-signature foundation for local CMS/PKCS#7, CAdES-adjacent, RFC 3161, RFC 5544, and public OpenPGP inspection.
• Preserves the contributor's synthetic, non-secret Issue [feature]: Add preview support for digital signatures, timestamps, ASiC, evidence records, and OpenPGP #206 fixture corpus and lazy rPGP Worker/WASM architecture without LGPL source.
• Keeps the renderer as an explicit optional package: it is not a dependency of preset-all, any of the eight *-full packages, core, or the standard renderer build.
• Adds the optional formats to the English and Chinese support guides, commits the Rust lockfile, verifies every fixture checksum, and makes CI read-only and reproducible.

Related issue

Related to #206. This PR lands the verified first-phase contribution; it does not by itself close the broader ASiC, evidence-record, PAdES, XAdES, JWS/JAdES, and signed-email roadmap in that issue.

Change classification

• User-visible UI or rendering change
• Non-visual change
• File-format or renderer behavior
• Public API, package, Worker, WASM, or deployment-path change

Verification

Check	Result
pnpm --filter @file-viewer/renderer-signature verify	Pass: 42 immutable fixture hashes, positive/negative CMS and timestamp checks, OpenPGP architecture/detection, and Chromium/Firefox/WebKit rendering
cargo check --locked --target wasm32-unknown-unknown	Pass with Rust 1.88.0 and committed Cargo.lock
pnpm --filter '@file-viewer/preset-all...' build	Pass
pnpm build:components	Pass: all 16 standard/full component packages; no signature code in Full output
pnpm verify:github-governance	Pass
Workflow YAML parse and git diff --check	Pass

The browser gate uses Playwright 1.61.1 in Chromium, Firefox, and WebKit. It renders the contributed encapsulated CMS fixture under CSP and Trusted Types, verifies the signature and content digest, rejects external requests, checks unsafe event attributes, and confirms cleanup after unmount.

Sample / fixture evidence

Repository fixture: encapsulated CMS fixture

• Corpus: packages/renderers/signature/test/fixtures/github-206-contributed/
• CMS: packages/renderers/signature/test/fixtures/github-206-contributed/cms/
• Timestamps: packages/renderers/signature/test/fixtures/github-206-contributed/timestamps/
• Negative inputs: packages/renderers/signature/test/fixtures/github-206-contributed/negative/
• Detached originals: packages/renderers/signature/test/fixtures/github-206-contributed/originals/

The corpus is synthetic and non-secret. Its root CA is intentionally untrusted, no private key is included, and all 42 committed files are checked against SHA256SUMS before semantic verification.

Visual evidence

Before: N/A — this is a new optional renderer with no previous UI.

After, rendered directly from this PR head and the contributed CMS fixture:

Risk and compatibility

• Affected packages/formats: the optional @file-viewer/renderer-signature package, its offline verification assets, and CMS/PKCS#7, RFC 3161, RFC 5544, and OpenPGP documentation entries.
• Compatibility or migration risk: low; the renderer remains opt-in and is not added to preset-all or any *-full package, so existing install size and default behavior are unchanged.
• Rollback: remove the optional renderer package and its documentation entries; no existing preset or full-package dependency graph needs to change.
• Existing Full installations do not change. A dependency-closure gate covers all eight *-full packages and preset-all.
• The optional OpenPGP path uses rPGP 0.20.0 under MIT OR Apache-2.0 in a lazy Worker/WASM boundary. No LGPL source is used or bundled.
• Parsing and cryptographic verification do not establish certificate trust, policy compliance, identity assurance, qualified-signature status, or legal validity. No external CA, CRL, OCSP, TSA, keyserver, or document URL is fetched automatically.
• Rollback is isolated: remove the optional package and its support-guide entry; existing renderers and Full dependency closures are unchanged.

Checklist

• I added or updated focused automated coverage, or explained why it is not needed.
• I updated user-facing documentation or release notes when behavior or API changed, or marked them not applicable.
• I verified offline/private-deployment paths when changing Worker, WASM, fonts, vendor assets, or URLs.
• I did not commit secrets, customer files, private samples, generated caches, or unrelated changes.

[wybaby168]

Thank you for cloning the repository, building the proof of concept, and contributing a useful synthetic fixture corpus—this is substantial work. We are validating it against the full release matrix; before merge, we will keep the signature renderer as an optional package (not included by default in full) and add it to the support matrix.