Bound malformed tokens, indices and placement recursion

[rihokirss]

Fixes #2150.

Bound EOF scanning and triangle access, detect cyclic/deep placements, and guard missing FILE_SCHEMA. Tokenizer failures now propagate through the loader to both OpenModel entry points, which close the failed model and return -1 instead of exposing a partial model. Bounded child-process tests cover malformed tokens after valid headers and records, callback/buffer loading, chunk boundaries and successful loads after repeated failures. Text-escape decoding is handled separately.

Validation on this branch's fresh Emscripten 4.0.10 builds: 11 PR regression tests and 89 existing functional/API tests pass in Node 24.13.0; 6 tests pass in headless Chromium using the browser WASM. The six browser cases cover late tokenizer rejection; native ASan/UBSan also passed 2400 tokenizer cases.

The test file and fixtures are introduced by this PR and are not yet in upstream main. The test constructs additional edge cases from the fixtures. To run it, use a clean checkout of the PR branch (with Emscripten configured):

git clone --single-branch --branch codex/pr-malformed-input https://github.com/rihokirss/engine_web-ifc.git web-ifc-repro-malformed-input
cd web-ifc-repro-malformed-input
npm ci
npm run build-release
npm test -- --runTestsByPath tests/functional/MalformedInput.spec.js

Reproduction: minimal IFC input; all fixtures; MalformedInput.spec.js.

Build environment: Node 24.13.0, Emscripten 4.0.10.

[rihokirss]

Thanks for updating the branch. I noticed the merge resolution dropped the missing/invalid FILE_SCHEMA guards in both OpenModel and OpenModelFromCallback. We should retain those checks alongside ALLOW_INCOMPATIBLE_SCHEMA_ALIASES, so a missing header returns -1 and closes the model instead of throwing. I can push a small follow-up to preserve both.

[beachtom]

Yeah I spotted that - will sort