…dline

Preview PNG rendering ran the whole protobuf->SVG->PNG pipeline
synchronously on the Express event loop through the process-wide WASM
DirectBackend, so one slow or pathological model stalled every
concurrently-multiplexed request on the instance (GAE allows 100) --
a regression from the 2022 per-request worker_threads design. Restore
that isolation: each render runs in its own worker thread with its own
WASM instance, behind a 2-slot FIFO limiter, under a 10s total
wall-clock budget that includes queue wait (a request whose deadline
lapses while queued rejects without spawning a doomed worker). A WASM
panic or OOM now kills a disposable thread, not the server. Failures
stay per-request: the preview route's existing 500 path is unchanged.

Cap automatic_scaling at 8 instances in app.yaml so a render storm or
crash loop cannot fan out cost without bound, and make
validate-app-prod-config.mjs refuse to deploy if the operator-local
.app.prod.yaml lacks max_instances. verify-deploy-build.sh and the
staged-deploy verify step now assert lib/render-worker.js ships,
because a build that dropped it would 500 every preview while looking
healthy. Addresses the isolation, timeout, and instance-cap facets of
issue 694; a model-complexity cap below the 10 MB body limit remains
open there.

…nd /static CORS

The embeddable web component was broken on third-party pages: the
engine runs in a Web Worker whose chunk URL resolves (via the
component build's assetPrefix 'auto') to an absolute app.simlin.com
URL, and the Worker constructor enforces same-origin regardless of
CORS, so embeds loaded project data but never initialized the engine.

Boot the worker through a same-origin blob: trampoline when the
resolved chunk URL is cross-origin: worker-trampoline.ts holds the
pure origin-decision and trampoline-source logic plus an injectable
spawn shell that briefly intercepts the global Worker constructor to
observe the URL the bundler resolved (the new Worker(new URL(...))
expression must stay inline or rspack stops bundling the worker
chunk). The imported chunk keeps its https URL identity, so its
internal WASM fetch resolves against app.simlin.com; engine-worker.ts
overrides the runtime publicPath in the trampolined (classic,
blob-origin) context where self.location would otherwise poison it.
The same-origin path -- the main app -- constructs through the native
Worker with identical arguments, verified against a rebuilt bundle.

Serve Access-Control-Allow-Origin: * on the /static GAE handler so
the trampoline's cross-origin import and the worker's WASM fetch pass
CORS; everything under /static is public build output.
validate-app-prod-config.mjs now requires the header in the
operator-local .app.prod.yaml, and the deploy smoke list gains a
header curl plus a real two-origin embed check (the remaining
browser-only semantics are uncoverable by unit tests; issue 825
tracks an automated Playwright harness).

gcloud app deploy uploads whatever .gcloudignore leaves in, entirely
independent of git tracking status, so a git-status-clean tree can
still trip App Engine Standard's hard 10,000-file cap on gitignored
artifacts (cargo target dirs, venvs, scratch checkouts) -- and the
failure only surfaced inside gcloud, after the expensive clean+build.
check-upload-file-count.sh enumerates the real upload set once via
gcloud meta list-files-for-upload immediately before each deploy and
aborts with a per-top-level-directory breakdown when the cap would be
hit. Both deploy paths run it: the root-path deploy because that is
where the unbounded exposure lives, the staged path as a cheap guard
against staging-assembly regressions. The cap parameter is
overridable only so the failure path can be exercised by hand against
a tiny fixture. With the .gcloudignore hardening that landed earlier,
this completes issue 695.