FE-1500: switch the example embed to the Petrinaut preview

[kube]

🌟 What is the purpose of this PR?

Switches the /embed/examples route from the full read-only Petrinaut component to PetrinautPreview with Quick Simulation. This is an optimization of the already-shipped embed: the compact surface loads no Monaco/LSP and adds bounded in-embed simulation. The embed URL contract does not change. Stacked on #9361.

🔗 Related links

• FE-1500

🔍 What does this change?

• EmbeddedExamplePage lazy-loads PetrinautPreview from @hashintel/petrinaut/preview and builds its quickSimulation from the build-time HIR artifacts (loadExampleRuntime) plus the catalog's parameter bounds; step size and horizon use the simulation defaults.
• The embed route loads the runtime artifacts alongside the model and navigates through a preview-typed codec (previewSearchToNavigationState and friends) over the same shared search subset.
• The normalizeEmbedSearch redirect is untouched; a fast-check property asserts the preview codec produces the same search as the shared codec on every generated input, so existing embed URLs keep working unchanged.

Pre-Merge Checklist 🚀

🚢 Has this modified a publishable library?

This PR:

• does not modify any publishable blocks or libraries, or modifications do not need publishing

📜 Does this require a change to the docs?

The changes in this PR:

• are internal and do not require a docs change

🕸️ Does this require a change to the Turbo Graph?

The changes in this PR:

• do not affect the execution graph

🛡 What tests cover this?

• New: the preview-codec laws in navigation-search.property.test.ts, including the codec-equivalence property that pins the URL contract across the switch.
• Existing: embed-route.test.ts and the shared codec laws pass unchanged.

❓ How to test this?

1. Checkout the branch, run yarn workspace @hashintel/petrinaut build:lib, then yarn workspace @apps/petrinaut-website dev.
2. Open http://localhost:5173/embed/examples/gases-1-pn (directly or inside an iframe).
3. Confirm the compact preview renders instead of the full editor, Quick Simulation runs with the timeline, and scenario/subnet/selection URLs from the previous embed still resolve identically.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
hash	Building	Preview	Sep 1, 2026 8:00am UTC
petrinaut	Ready	Preview	Sep 1, 2026 8:00am UTC
petrinaut-docs	Ready	Preview	Sep 1, 2026 8:00am UTC

1 Skipped Deployment

Project	Deployment	Actions	Updated
hashdotdesign-tokens	Ignored	Preview	Sep 1, 2026 8:00am UTC

[semgrep-code-hashintel]

Semgrep found 4 detect-replaceall-sanitization findings:

• apps/petrinaut-website/api/oembed.ts
  • L87-92 - Triage
  • L87-91 - Triage
  • L87-89 - Triage
  • L87-88 - Triage

Detected a call to replaceAll() in an attempt to HTML escape the string value .replaceAll("&", "&amp;") .replaceAll('"', "&quot;") .replaceAll("'", "&#39;") .replaceAll("<", "&lt;"). Manually sanitizing input through a manually built list can be circumvented in many situations, and it's better to use a well known sanitization library such as sanitize-html or DOMPurify.

Semgrep found 1 regex_dos finding:

• apps/petrinaut-website/src/main/app/brunch-demo/brunch-endpoint.ts
  • L8-18 - Triage

Ensure that the regex used to compare with user supplied input is safe from regular expression denial of service.