feat(avatar): replace legacy renderer with 3D SDK

[NWYLZW]

Summary

• Replace the legacy 2D pixel @oneworks/avatar implementation with the versioned 3D Avatar SDK and React renderer throughout the client.
• Consume the independently owned core, React, Vue, Vanilla/Web Component, editor, and custom-animation surfaces from assets/avatar.
• Update workspace bootstrapping, validation/deploy paths, release ownership, bilingual developer docs, and the rc.6 changelog.
• Preserve custom images and deterministic seeded 3D fallbacks across room, entity, account, message, and group-avatar surfaces.

Changelog

• changelog/1.0.0-rc.6/avatar.md

Screenshot

The screenshot is from the current parent worktree runtime at 1440×960. SHA-256: 90fb23ef44a2e7578b2cca40ed3d62105d3c16ddfe8daf67f3545fb1379965a8.

Release and deployment evidence

• Avatar implementation PR oneworks-ai/avatar#8 merged after independent review.
• Token-capable protected release workflow PR oneworks-ai/avatar#10 merged after independent security review; OIDC remains the default and token mode is explicit, environment-scoped recovery.
• Avatar SDK publication run 32656111655 succeeded.
• Published @oneworks/avatar, @oneworks/avatar-react, @oneworks/avatar-vue, and @oneworks/avatar-web at 1.0.0-rc.6; all four rc tags and exact npm provenance were postflight verified.
• GitHub prerelease sdk-v1.0.0-rc.6 targets protected-main source c7b1847da43bc7043058dbcc89bdfb5896e3cffe.
• PWA submodule initialization PR oneworks-ai/pwa#2 merged; its production-build dry run 32653682783 passed against this delivery line.

Validation

• 122 affected parent Vitest tests
• Full parent pnpm typecheck
• Client Vite production build
• Bilingual VitePress docs production build
• pnpm exec dprint check
• Production dependency audit
• Clean-checkout pnpm install --frozen-lockfile --lockfile-only
• pnpm tools publish-plan -- --json excludes the four independently released public Avatar packages and retains private @oneworks/avatar-assets
• Cold-worktree and concurrent Avatar submodule bootstrap tests
• Independent runtime visual review across room/header/message/account/entity/group/custom-image/fallback surfaces, light/dark themes, and 14–56px sizes: PASS
• Latest parent CI: lint, typecheck, format, docs, client build, release tags, relay, extension, Vercel, and macOS packaging checks passed
• git diff --check

Review Scope

• Risk: high
• Applicable profiles: frontend, public docs, workspace/release, submodule dependency boundary
• Evidence: local validation, exact-head CI, npm provenance postflight, PWA build dry run, independent code/security/policy review, and independent visual review
• Rule exceptions: none

Experience Review

• 已判断是否需要沉淀经验
• 如需要，已运行 $post-task-experience-review
• reviewer PASS / NOT APPLICABLE 后才进入 merge

Result: PASS. Accepted feedback was classified; no additional durable visual rule was required (NO_DURABLE_LEARNING).

Policy Conflict Review

• Independent read-only reviewer checked workflow, permission, and release-rule conflicts and reported PASS

The source-coupled Avatar submodule, independent npm release ownership, PWA checkout, maintenance guidance, and release-policy exception are aligned with the implemented workflow.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
oneworks-dev	Ignored	Preview	Aug 23, 2026 6:03pm

[github-actions]

Experience Review

Before merge, make sure the PR body contains this completed checklist:

## Experience Review
- [x] 已判断是否需要沉淀经验
- [x] 如需要，已运行 `$post-task-experience-review`
- [x] reviewer `PASS` / `NOT APPLICABLE` 后才进入 merge

Checklist to confirm:

• Decide whether this PR produced reusable project experience.
• If experience should be captured, run $post-task-experience-review.
• Merge only after the independent reviewer reports PASS or NOT APPLICABLE for the Experience Review Result.
• For workflow, permission, or release-rule documentation changes, also add this checked section to the PR body after an independent read-only conflict review:

## Policy Conflict Review
- [x] Independent read-only reviewer checked workflow, permission, and release-rule conflicts and reported PASS