FE-1500: add the embedded Petrinaut preview

[kube]

🌟 What is the purpose of this PR?

Adds PetrinautPreview, a compact read-only surface for showing a Petri net inside another application, exported from a new @hashintel/petrinaut/preview entry. It reuses the editor's canvas, navigation, and property inspection; editing, Monaco/LSP, experiments, optimizations, and the AI assistant are not mounted. Stacked on #9363.

🔗 Related links

• FE-1500

🔍 What does this change?

• Splits PetrinautProvider into reusable layers: PetrinautDocumentProvider (instance, net management, undo/redo bridge, SDCPN) and PetrinautCanvasProvider (playback, user settings, active net, editor, execution frame). The provider's behaviour is unchanged; the preview composes the layers without workers.
• Adds src/ui/preview/: the PetrinautPreview component (in-memory read-only document, header with net selector and View only badge), a navigation adapter projecting the preview's smaller URL contract (PetrinautPreviewNavigationState: scenario, subnet, selection) onto the full controller, and a compact properties panel that is a side overlay on wide embeds and a bottom sheet on narrow ones.
• Adds the preview presentation profile (no mutation actions, no source code, no custom visualizers, compact controls) and narrows the editor's presentationProfile prop to exclude it.
• Registers the user-guide page docs/preview.md in the docs index and the AI assistant's doc list.

Pre-Merge Checklist 🚀

🚢 Has this modified a publishable library?

This PR:

• modifies an npm-publishable library and I have added a changeset file(s)

📜 Does this require a change to the docs?

The changes in this PR:

• require changes to docs which are made as part of this PR

🕸️ Does this require a change to the Turbo Graph?

The changes in this PR:

• do not affect the execution graph

🛡 What tests cover this?

• New: ui/preview/navigation-adapter.test.ts.
• Existing: the docs enforcement tests (ai.test.ts, petrinaut-docs-content.test.ts) verify the new page's registration; build:lib verifies the new entry.

❓ How to test this?

1. Checkout the branch and run yarn workspace @hashintel/petrinaut build:lib.
2. Render <PetrinautPreview definition={...} title="..." /> from @hashintel/petrinaut/preview in a host page.
3. Confirm pan/zoom/fit/minimap work, selection opens the compact inspector, the net selector switches subnets, and no editing affordance appears.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hash	Ready	Preview	Aug 30, 2026 3:43am
petrinaut	Ready	Preview	Aug 30, 2026 3:43am
petrinaut-docs	Ready	Preview	Aug 30, 2026 3:43am

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
hashdotdesign-tokens	Ignored	Preview	Aug 30, 2026 3:43am

[cursor]

PR Summary

Medium Risk
Refactors the main provider tree (behavior should be equivalent for the full editor) and adds a new public package entry that embedders will rely on for read-only UX and URL state.

Overview
Adds PetrinautPreview, a compact read-only embed exported from @hashintel/petrinaut/preview, for hosts that need iframe-friendly net viewing without the full editor.

PetrinautProvider is split into PetrinautDocumentProvider and PetrinautCanvasProvider so Preview can reuse the same SDCPN canvas, inspector content, and subnet navigation while skipping LSP, simulation, experiments, optimizations, and AI. Preview builds an in-memory readonly document from an SDCPN snapshot and uses a preview presentation profile (no mutations, source, or custom visualizers; compact controls and minimap kept).

Hosts can drive deep links via optional navigation limited to scenario, subnet, and selection; a navigation adapter maps that smaller contract onto the shared navigation provider. User guide preview.md is wired into the docs index and AI readPetrinautDoc catalog; patch changesets cover @hashintel/petrinaut and @hashintel/petrinaut-core.

^{Reviewed by Cursor Bugbot for commit f90fdcd. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit ec16eaa. Configure here.}

[cursor]

Net selector stays open after pick

Low Severity

Choosing a root net or subnet in PreviewNetNavigation never closes the popover. NetNavigationList only updates the active net, and this shell never ties that selection back to setOpen. The menu stays up until the user clicks outside, which is unexpected for a compact net picker on a small embed.

 

^{Reviewed by Cursor Bugbot for commit ec16eaa. Configure here.}

[semgrep-code-hashintel]

Semgrep found 4 detect-replaceall-sanitization findings:

• apps/petrinaut-website/api/oembed.ts
  • L86-91 - Triage
  • L86-90 - Triage
  • L86-88 - Triage
  • L86-87 - Triage

Detected a call to replaceAll() in an attempt to HTML escape the string value .replaceAll("&", "&amp;") .replaceAll('"', "&quot;") .replaceAll("'", "&#39;") .replaceAll("<", "&lt;"). Manually sanitizing input through a manually built list can be circumvented in many situations, and it's better to use a well known sanitization library such as sanitize-html or DOMPurify.