fix(ci): scope LOC check to studio, split useTimelinePlayer + hyperframes-player under 500 LOC (#750)

* refactor: split useTimelinePlayer.ts and hyperframes-player.ts into focused modules (<500 LOC each)

* fix(ci): scope 500 LOC check to packages/studio, add allowlist for grandfathered files

* feat(cli): Linux ARM64 support — auto-install Chromium on DGX Spark / GB10 / Jetson

Chrome Headless Shell has no Linux ARM64 binary. On arm64 Linux:
- Detects the platform automatically
- Tries to auto-install system Chromium via apt-get (works on Ubuntu/Debian ARM)
- Falls back to clear manual instructions with exact commands
- 'hyperframes browser ensure' guides through the setup interactively
- After setup, all render commands work without any flags

* fix(ci): disable Windows Defender real-time monitoring to prevent EPERM builds

Path exclusions are insufficient — Defender re-scans new files created
during bun install before the exclusion takes effect. Disable real-time
monitoring for the entire job duration instead (standard CI practice).

* refactor(studio): split all files >500 LOC + extract useToast, delete allowlist

All 11 large files split into focused modules under 500 LOC.
App.tsx extracted toast logic into useToast hook (493 LOC now).
.filesize-allowlist deleted — no longer needed.

* fix: remove unused imports from split files, extract useToast from App.tsx

App.tsx: 504 → 493 lines (toast logic extracted to useToast hook)
timelineDOM.ts: remove unused imports from re-export pattern
MotionPanel.tsx: remove unused clampStudioCustomEasePoints import
studioMotionOps.ts: remove unused StudioGsapMotionDirection import

* fix(ci): use Set-MpPreference to fully disable Windows Defender (both jobs)

* fix(producer): use node --experimental-strip-types instead of tsx for build:fonts

Eliminates the tsx binary dependency that Windows Defender locks during
bun install, causing EPERM errors. Node 22.6+ strips TypeScript types
natively with no external binary.

* chore: remove .filesize-allowlist — App.tsx is now 493 lines (<500)

* fix(ci): disable Windows Defender before checkout to prevent all EPERM races

* fix(producer): skip build:fonts if fontData.generated.ts already exists

The generated file is tracked in git, so CI doesn't need to regenerate
it. This avoids @fontsource/inter node_modules access on Windows which
triggers EPERM from Defender scanning during bun install.

packages/cli/src/commands/browser.ts

@@ -15,12 +15,47 @@ import {
   clearBrowser,
   CHROME_VERSION,
   CACHE_DIR,
+  isLinuxArm,
 } from "../browser/manager.js";
 import { trackBrowserInstall } from "../telemetry/events.js";
 
 async function runEnsure(): Promise<void> {
   clack.intro(c.bold("hyperframes browser ensure"));
 
+  // ARM64 Linux: Chrome headless shell is not available.
+  // Try to find system Chromium first, then attempt auto-install via apt.
+  if (isLinuxArm()) {
+    const s = clack.spinner();
+    s.start("Linux ARM64 detected — looking for system Chromium...");
+    const existing = await findBrowser();
+    if (existing) {
+      s.stop(c.success("System Chromium found"));
+      console.log();
+      console.log(`   ${c.dim("Source:")}  ${c.bold(existing.source)}`);
+      console.log(`   ${c.dim("Path:")}    ${c.bold(existing.executablePath)}`);
+      console.log();
+      clack.outro(c.success("Ready to render."));
+      return;
+    }
+
+    s.stop(c.warn("No Chromium found — attempting auto-install via apt-get..."));
+    console.log();
+
+    // Delegate to ensureBrowser which handles the full ARM64 install flow.
+    try {
+      const result = await ensureBrowser();
+      console.log();
+      console.log(`   ${c.dim("Source:")}  ${c.bold(result.source)}`);
+      console.log(`   ${c.dim("Path:")}    ${c.bold(result.executablePath)}`);
+      console.log();
+      clack.outro(c.success("Chromium ready. You can now render on ARM64."));
+    } catch (err) {
+      clack.log.error(err instanceof Error ? err.message : String(err));
+      clack.outro(c.warn("Manual setup required (see instructions above)."));
+    }
+    return;
+  }
+
   const s = clack.spinner();
   s.start("Looking for an existing browser...");