fix(reliability): contain Hangul engine cleanup failures

[seonghobae]

Current authoritative state

This cleanup-containment defect is repaired on the existing canonical single-writer Draft PR #320 / branch feat/hwp-hwpx-authoring. Protected shipped truth remains main@3b38ead2d00f44eb578d0689087b9293b3dabe1e; current exact Draft head is 5ee6e4d0c3b2a804f39a8d186a8bdd7c2a38a782.

Current src/hangul/index.ts routes both public import and export cleanup through module-owned freeHangulDocument(). Unknown host cleanup throws are caught without reading, stringifying, coercing, or otherwise reflecting the thrown value. If cleanup fails after an otherwise successful operation, Inkspan surfaces the stable payload-redacted HangulDocumentError('ENGINE_CLEANUP_FAILED', 'The Hangul engine failed during cleanup.'). If a normalized primary import/export HangulDocumentError already exists, that primary failure remains authoritative and the secondary cleanup failure is contained.

This remains Inkspan-owned local adapter reliability/error-containment scope. The host continues to own the HWP/HWPX engine, filesystem/network/WASM initialization, credentials, persistence, publication, and telemetry.

Test-first lineage

• RED 4481666a6bbddb467ac0d9318c45d3b37a411cad proved host free() throws could escape or replace an existing normalized Inkspan failure.
• GREEN 521900fde4347bc8b9cb4b966d7f1a930e9c7155 introduced the module-owned cleanup boundary and stable ENGINE_CLEANUP_FAILED behavior while preserving an already-established primary error.
• Current exact head 5ee6e4d0c3b2a804f39a8d186a8bdd7c2a38a782 carries that repair together with the broader feat(hangul): import, edit, and export HWP/HWPX #320 Hangul lane, including later engine-boundary hardening. Predecessor workflow/review evidence does not transfer after head movement.

Exact-current-head evidence

For unchanged exact head 5ee6e4d0c3b2a804f39a8d186a8bdd7c2a38a782 against protected main@3b38ead2d00f44eb578d0689087b9293b3dabe1e at the latest fresh refetch:

• CI 32395091285: completed / success; build/test 96510085342 checked out the exact head and completed 161 files / 898 tests at 100% statement/branch/function/line coverage, with package/build verification;
• Office Python 3.11-3.14 and cross-engine Playwright jobs: completed / success;
• Security Scan 32395091192: completed / success;
• SAST Semgrep 32395091052: completed / success;
• qualifying latest-push independent approval remains absent / non-passing;
• GitHub reports the Draft mechanically mergeable, which is not integration authorization.

All observed repository-owned exact-head workflows are terminal success. The absent qualifying approval remains non-passing; repository technical success does not replace separately applicable central or review governance.

Integration boundary

The behavioral defect is repaired on active Draft #320 but is not protected-main shipped behavior. Keep this issue open until #320 integrates under live governance. Keep #320 Draft/unmerged while #118 owns the frozen v0.6.0 publication/provenance boundary. Any #320 head/base/ruleset movement invalidates corresponding exact-head evidence and requires fresh revalidation. Do not create a competing Hangul writer, transfer predecessor evidence, self-approve, weaken gates, move protected main, or fabricate release identity.