Regression audit + fixes - #747

The new setter validation rejected non-finite values, which removed the
only opt-out from the 1e4 default: infinity is the pre-1.1.0 unbounded
behavior and the camera-controls default, and large-scale scenes need
it. Accept +inf for the max bound (NaN and <= 0 still raise); the min
bound stays strictly finite.

Two coverage holes that hid this cycle's worst bugs:

- test_mobile_breakpoint.py: a mobile-width load must not mount the
  canvas desktop-first and remount it (counts WebGL context creations
  and canvas removals against a desktop self-baseline), and the mobile
  bottom sheet must reflect server-side panel visibility updates.
- test_touch_gesture_mutex.py: while a divider resize is in progress
  via one touch, a second concurrent touch on a floating window's grip
  must be ignored (spec 4, one active gesture at a time), driven as
  real multi-touch through CDP Input.dispatchTouchEvent.

Both verified to fail against a client built from the pre-fix sources
and pass against the fixed build.

…uite

Twice on CI (py3.9 shard 2: runs 30298026392 attempt 1 and 30418320431)
the per-worker Vite dev server wedged permanently partway through the
run: page.goto kept succeeding but the module graph never completed, so
the dock never mounted and all remaining playground tests on that worker
burned the full 60s timeout twice each -- 17 consecutive failures over
~30 minutes, with orphaned esbuild children left behind (the dependency
optimizer hanging is the prime suspect). The failure onset shifted
between the two runs, so it is not tied to a specific test, and unlike
the documented 2026-07-18 starved-runner incident it never recovers on
its own -- which means the existing generous-timeout hardening cannot
help. Waiting cannot rescue a wedged server; a restart can.

- tests/e2e/vite_manager.py: extract the dev-server process management
  from the conftest fixture into a restartable ViteServerManager. The
  server now runs in its own process group and teardown signals + waits
  on the WHOLE group (escalating to SIGKILL), fixing the esbuild orphan
  leak: `proc.terminate()` only killed the npx wrapper, and waiting on
  the direct child returned as soon as npx died while node/esbuild
  lived on. stdout/stderr now go to a log file instead of DEVNULL, and
  the tail is printed on restart so a future wedge is diagnosable.
- dock_helpers.open_playground: after the existing two page-boot
  attempts fail, restart the worker's Vite server and make one final
  attempt against the fresh process -- turning the 30-minute cascade
  into a ~2 minute self-heal with zero test failures. The third attempt
  only exists when a managed server was actually restarted.
- conftest: the vite_server fixture now just owns a manager's lifetime.

Validated end-to-end outside CI: normal boot, SIGSTOP-simulated wedge
(two failed attempts -> restart with log tail -> healed boot on the
same port), old process group fully reaped, and teardown leaving no
processes. ruff check/format clean; playground tests pass through the
new fixture path.

An advocate/critic subagent panel reviewed the PR's effective diff vs
main. The advocate independently re-ran the falsification protocol (all
new Python and client regression tests fail on pre-fix sources, pass on
the branch); the critics surfaced the defects fixed here, each verified
against the code before fixing.

Tunnel (should-fix): the dead-tunnel replacement path leaked one
SyncManager child process + watcher thread per request_share_url retry
while the share backend was unreachable. A tunnel that ends "failed"
never sets _connect_event, so on_connect's wait_job blocked forever,
pinning the mp.Manager proxies; pre-fix the leak was bounded at one
because the failed tunnel poisoned the slot, but the replacement branch
creates a fresh tunnel per retry. ViserTunnel.close() now releases the
watcher (wait_job gains a status guard so the release cannot fire the
connect callback; _connect_job stores "connected" before setting the
event, making the guard race-free). Pinned by
test_close_of_failed_tunnel_releases_watcher_thread, verified to fail
pre-fix. Also: the failed tunnel's on_disconnect no longer broadcasts
ShareUrlUpdated(None) when a newer tunnel owns the slot -- the message
persists in the broadcast buffer, so the stale None also hit late
joiners.

InstancedMesh2 (should-fix, vendored -- LOCAL_PATCHES.md updated):
a frame drawn in the dispose->unmount window crashed the shadow pass:
shadow maps render BEFORE the main pass, onBeforeShadow only guarded
its culling call, and the unconditional instanceIndex.update()
dereferenced the nulled attribute (any shadow-casting batched mesh,
the Python API default). onBeforeShadow now has the same null gate as
onBeforeRender. LOD levels are separate meshes with per-level
geometries, so dispose() now drops each level geometry's retained
instanceIndex attribute too, instead of leaving them binding the freed
GL buffer. Both pinned by new dispose tests, verified to fail pre-fix.

Mobile sheet test gap (should-fix): panelUpdates.test.ts pinned the
equality utilities but not the component wiring -- reverting
PanelsFallback to key-set equality left the suite green. The comparator
choice now lives in panelsEquality.ts (imported by the component), and
the test pins both the module identity and, via a ?raw source
assertion, the selector call site.

Harness nits: vite_manager falls back to direct-child terminate on
Windows (os.killpg/getpgid are POSIX-only; the old fixture worked
everywhere), and a failed mid-suite vite restart no longer masks the
page-boot diagnostic (open_playground re-raises the page error with the
restart failure chained).

Gates: ruff check/format clean; targeted Python suites 49/49 (new leak
test fails on pre-fix code); tsc, eslint, prettier clean; client suite
637/637 with the four new pins failing on pre-fix sources.

Conflict: LOCAL_PATCHES.md -- both sides appended new patch sections.
Kept main's frustum-culling/sorting patches as 2-4 and renumbered this
branch's dispose-window patch to 5.