fix(accessibility): reject invalid runtime text direction values

[seonghobae]

Buyer-visible accessibility boundary

Protected main@3b38ead2d00f44eb578d0689087b9293b3dabe1e types textDirection as ltr | rtl | auto, and canonical accessibility documentation promises those exact HTML dir states. The historical defect was that buildEditorAccessibilityAttributes() copied a truthy hostile runtime value directly into the editable surface's dir attribute instead of enforcing the finite public contract.

JavaScript consumers, deserialized configuration, or TypeScript callers crossing an unknown boundary therefore required a fail-closed runtime boundary in addition to compile-time typing. This remains distinct from host responsibility to choose the correct valid direction; Inkspan owns enforcement of its own enumerated public runtime contract.

Canonical owner and implemented contract

Draft PR #230 is now the sole active writer for src/components/editorAccessibility.ts and the focused metadata/runtime tests. The older standalone direction lane #203 is superseded by that consolidated writer and must not be revived as a competing source branch.

At exact #230 head 59d82f8b65cfad5230fa9e11afb97867293a43f5, direction state is snapshotted once, accepts only undefined, ltr, rtl, or auto, and rejects other runtime values with the stable payload-redacted local contract before attributes are emitted. The same writer also closes the validation-to-use getter/Proxy gap without touching the separately owned public CwlEditor.editable contract.

Representative direction RED lineage is 173c1c8b6165ccffd4d46abdf005e6aa7fe64cf9. Exact-current #230 repository workflows are terminal success: CI 32322070195, Security Scan 32322070146, and SAST Semgrep 32322070224. Predecessor evidence does not transfer.

Acceptance

1. Preserve valid ltr, rtl, auto, and absence semantics while failing closed on hostile runtime direction values.
2. Preserve live standalone/collaborative prop updates, blank optional metadata omission, accessible-name precedence, readonly/required/invalid states, and valid direction behavior.
3. Do not infer direction, normalize aliases/case, or add host locale/document policy, transport, persistence, credentials, tenancy, model/provider, network, or durable-audit authority.
4. Maintain exact owned-production coverage and all applicable package/browser/Office/security gates on the eventual integration head.
5. Close only when canonical fix(accessibility): harden editor metadata runtime contracts #230 integrates into protected main; Draft/head-green evidence is not protected shipped truth.

Integration boundary

Keep #230 Draft/unmerged while #118 freezes protected main for v0.6.0 operational acceptance and while qualifying independent approval plus every then-live merge/review/governance gate remain incomplete. Do not advance protected main, duplicate #230's source ownership, or transfer predecessor CI/review evidence.