fix(xlsx): preserve DrawingML placement and resolve the actual Normal font

[wybaby168]

Summary

Move XLSX file semantics into the maintained parser so consumers do not need to reopen the ZIP to recover lost layout metadata.

• Preserve image anchor container kind, explicit editAs, exact EMU extents and absolute positions alongside the existing cell markers and offsets.
• Keep fractional compatibility dimensions instead of prematurely rounding them to 96-DPI pixels.
• Preserve one-cell, two-cell and absolute placement through read/write/read, cloning and worker-safe structured cloning. Include fallback pictures inside AlternateContent without treating grouped-child transforms as sheet coordinates.
• Resolve the Normal font via builtinId=0 -> cellStyleXfs -> fontId, without altering the font table used by cell styles.
• Make pinned Git installs build the actual maintained runtime through npm's prepare lifecycle.

This is an additive model contract. Browser DPI, zoom, hidden-row grid geometry, text measurement and DOM reflow remain renderer responsibilities. No customer workbook, image, identifying business content, screenshot-specific sizing rule or font file is included.

Verification

At 638a8f29f26883fa03ee254259e395c7d9e962e6, the read-only Drawing layout integration workflow passed:

• Package build and 23 new public parser/writer/clone contract tests.
• Full repository TypeScript checks.
• Full existing Vitest library suite, with the exact-equality image expectations extended for the additive metadata (not weakened).

Run: https://github.com/flyfish-dev/hucre/actions/runs/35436703277

npm run test:drawing-layout reproduces the new generated-fixture checks. This does not claim support for all grouped DrawingML transforms or arbitrary picture effects.

[wybaby168]

Coverage gate: verified pre-existing baseline failure

The unchanged PR base 37ca77cb10d65039693b6c6478bf495be4aff4b2 was checked out independently and tested with its original frozen pnpm lockfile and coverage configuration. All 10,649 base tests passed, but its existing global coverage thresholds already fail:

Metric	Unchanged base	Required
Statements	96.94%	98.5%
Branches	95.15%	96%
Functions	97.01%	98%
Lines	97.52%	99%

Reproduction log: https://github.com/flyfish-dev/hucre/actions/runs/35437702987/job/105883073245

This PR does not lower coverage thresholds, exclude production modules from coverage, skip the original coverage job, or change the base branch. A separate informational baseline job makes this distinction explicit; it is not a substitute for the enforced coverage gate.

The new DrawingML validation/Normal-font unit tests are now also included in Vitest coverage, alongside the 23 post-build public parser/writer/clone tests. The formatter issue has been corrected using the exact repository formatter output. Rendering integration is in flyfish-dev/excel-viewer#20, whose final CI, security check, clean packed-consumer checks, and 48 browser drawing scenarios have passed.