FE-1500: add editor presentation profiles

[kube]

🌟 What is the purpose of this PR?

Adds a presentationProfile prop to Petrinaut (editor or review) that gates authoring-only controls, and extracts scenario and playback controls into shared components so later surfaces can compose them outside the full editor. Stacked on #9363.

🔗 Related links

• FE-1500

🔍 What does this change?

• New PetrinautPresentationProvider context maps a profile to capability booleans (showMutationActions, showSourceCode, showCustomVisualizers, showViewportSettings, showMinimap, compactControls). The default editor profile keeps every capability on, so existing hosts are unchanged; review suppresses authoring actions for read-only pages.
• Gates existing editor UI on those capabilities: subnet add/rename/delete affordances, type-dimension mutation controls, source-code fields in property inspectors, the custom place visualizer, viewport settings, and the minimap.
• Extracts shared components out of editor internals: SelectedItemProperties from PropertiesPanel/panel.tsx, SimulationScenarioControls and simulation-parameter-bounds from simulation-settings.tsx, and a compact variant of the bottom-bar SimulationControls and PlaybackSettingsMenu (with an allowedSpeeds allow-list).
• Adds a Fit view button to the viewport controls and moves the Monaco code field and place visualizer behind React.lazy boundaries (createDeferredSubView).
• Adopts the review profile on the website's full example page and embed page, which until this PR rely on readonly alone (authoring controls disabled instead of hidden).

Pre-Merge Checklist 🚀

🚢 Has this modified a publishable library?

This PR:

• modifies an npm-publishable library and I have added a changeset file(s)

📜 Does this require a change to the docs?

The changes in this PR:

• are internal and do not require a docs change

🕸️ Does this require a change to the Turbo Graph?

The changes in this PR:

• do not affect the execution graph

🛡 What tests cover this?

• New: simulation-parameter-bounds.test.ts.
• Existing: the @hashintel/petrinaut unit suite runs the editor with the default profile.

❓ How to test this?

1. Checkout the branch and run yarn workspace @hashintel/petrinaut build:lib, then yarn workspace @apps/petrinaut-website dev.
2. Confirm the editor is unchanged with the default profile on /: property panels, scenario controls in Simulation Settings, playback bar, viewport controls.
3. Open an example page (/examples/gases-1-pn) and confirm add/delete/rename affordances and source-code fields are hidden rather than disabled.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
hash	Ready	Preview	Sep 1, 2026 12:03pm UTC
petrinaut	Ready	Preview	Sep 1, 2026 12:03pm UTC
petrinaut-docs	Ready	Preview	Sep 1, 2026 12:03pm UTC

1 Skipped Deployment

Project	Deployment	Actions	Updated
hashdotdesign-tokens	Ignored	Preview	Sep 1, 2026 12:03pm UTC

[semgrep-code-hashintel]

Semgrep found 4 detect-replaceall-sanitization findings:

• apps/petrinaut-website/api/oembed.ts
  • L86-91 - Triage
  • L86-90 - Triage
  • L86-88 - Triage
  • L86-87 - Triage

Detected a call to replaceAll() in an attempt to HTML escape the string value .replaceAll("&", "&amp;") .replaceAll('"', "&quot;") .replaceAll("'", "&#39;") .replaceAll("<", "&lt;"). Manually sanitizing input through a manually built list can be circumvented in many situations, and it's better to use a well known sanitization library such as sanitize-html or DOMPurify.

[semgrep-code-hashintel]

Semgrep found 1 regex_dos finding:

• apps/petrinaut-website/src/main/app/brunch-demo/brunch-endpoint.ts
  • L8-18 - Triage

Ensure that the regex used to compare with user supplied input is safe from regular expression denial of service.