fix(core): wrap observer-object handlers like functions, and let a wrapped promise settle after teardown - #3829

Fixes #3828

• ɵzoneWrap now wraps a handler passed as an observer object the way it wraps a handler passed as a function, for the 11 functions whose declared parameters include an observer. Firebase receives a copy of the object whose next, error, complete, onNext, onErr and onComplete members are wrapped and bound to the caller's object.
• tools/build.ts finds those 11 at build time by reading Firebase's type declarations with the TypeScript compiler API, and passes them a fourth ɵzoneWrap argument, true. Every other wrapped function passes its object arguments through untouched.
• onConfigUpdate (remote-config) gets blockUntilFirst: false, because wrapping its observer at true would hold the application unstable until a config update a normal load may never produce.
• The promise branch resolves and rejects directly, dropping the runInInjectionContext and NgZone.run layers that never reached the caller and threw once the injector was destroyed.
• A handler Firebase calls after its injector is destroyed now runs instead of throwing NG0205, in both forms.

Checklist

• Issue number for this PR: ɵzoneWrap ignores a handler passed as an observer object, and holds a wrapped promise forever once its injector is destroyed #3828
• Docs included?: no. One sentence in docs/zones.md, saying the re-entry holds for a handler passed as an object too, goes in the rc.1 docs PR, docs: document the 22.0.0-rc.1 changes #3835.
• Test units included?: yes. src/zones.spec.ts has fifteen cases, each run under provideZoneChangeDetection() and under provideZonelessChangeDetection(). src/firestore/firestore.spec.ts has one more, against the real setDoc and the emulator.
• Breaking change?: no
• In a clean directory, yarn install, yarn test run successfully?: yes, with npm: npm ci, npm run build, npm test (which runs build:jasmine, test:node-esm and test:chrome-headless), plus npm run test:node and npm run lint.

Changes

Before this change the argument loop in ɵzoneWrap tested typeof _arguments[i] === 'function' and nothing else, so an observer object reached the SDK untouched. The issue lists the eleven affected functions and what each form lost.

The first commit:

• Adds isObserverLike, true for a non-null object with a function under any of the six member names, and zoneWrapObserver, which returns a copy of the object with those members replaced by the same wrapper a function argument gets.
  • The copy keeps the caller's object untouched, so one observer can be reused across calls, and .bind(observer) keeps this for a class instance or an RxJS Subject.
• Adds onConfigUpdate: { blockUntilFirst: false, logLevel: LogLevel.WARN } to the remote-config block of tools/build.ts.
  • Its handler runs only when a fetched template differs from the active one.
  • Adds the same entry for app-check's onTokenChanged, which fix: stop twelve wrapped calls from holding the app unstable #3827 also added on main, so after the merge only the onConfigUpdate entry is new.

The second commit:

• Replaces ret.then((it) => runInInjectionContext(injector, () => run(() => resolve(it))), ...) with ret.then(resolve, reject).
  • The two layers never reached the caller's continuation, and their assertNotDestroyed check is what hung a promise settling after teardown (the issue has the details).
  • The pending task still opens on the call and closes on settlement.

The third commit:

• Narrows the first commit, which treated any object argument with one of those members as an observer. A model class with a complete() method, saved through setDoc with a converter, reached the converter as a plain copy without its prototype, and the call's pending task was never released.
• Adds exportsTakingAnObserver to tools/build.ts. It type-checks an in-memory file that imports each Firebase entry point, and keeps the exports with a parameter whose type is an object with a function-valued observer member.
  • Those 11 exports are generated as ɵzoneWrap(fn, blockUntilFirst, logLevel, true).
  • ɵzoneWrap looks for an observer object only when that fourth argument is true.
• Makes zoneWrapFn call the handler directly when injector.destroyed is true. Before, a handler Firebase called after ApplicationRef.destroy() or a TestBed reset threw NG0205, which already happened on main for handlers passed as functions.

The merge of main:

• Brings in fix: stop twelve wrapped calls from holding the app unstable #3827, feat: accept firebase 13 alongside firebase 12 #3831 and feat(zones)!: deliver Observable read values as microtasks #3833.
• The remote-config override block keeps both fix: stop twelve wrapped calls from holding the app unstable #3827's isSupported entry and this PR's onConfigUpdate entry.
• src/zones.spec.ts, which both sides created, keeps both sets of specs.
• The generated files come from the merged build.

What callers can notice

• onSnapshot(ref, { next }) and the other object-form calls now hold server rendering until the first value, run their members inside the Angular zone, and can call inject() inside them, exactly like the function form.
• onConfigUpdate, which never held the application unstable (its only form was never wrapped), does not start to now that its observer is.
• Every other wrapped function, setDoc included, receives its object arguments exactly as before this PR.
• A wrapped promise that settles after its injector is destroyed now settles. Nothing else about the promise branch changes: the continuation's zone and the behavior of inject() inside it are the same as before.
• A handler that runs after its injector is destroyed runs without the Angular zone and the injection context, instead of throwing NG0205.
• The SDK receives a copy of the observer rather than the caller's object. None of the eleven SDK functions compares the object's identity: each reads or binds its members, or keeps the object it received and removes that same one on unsubscribe.

Verification

• Removing the injector.destroyed check from zoneWrapFn fails the new teardown spec in both modes with NG0205: Injector has already been destroyed.
• Removing the fourth-argument check from ɵzoneWrap fails five specs: the two data-object cases in both modes, and the Firestore setDoc converter spec.
• Full karma suite in headless Chrome on the merged branch: 169 of 169 pass. npm run test:node and npm run test:node-esm: 401 specs, 0 failures each. npm run lint passes.
• With firebase 13.1.0 installed in place of 12.19.0, the build flags the same 11 exports.
• Measured in Chrome on a zone.js Angular 22.2 app and a zoneless one with the built tarball installed, against the Firestore emulator, through the generated @angular/fire/firestore and @angular/fire/remote-config entry points: the object form matches the function form on pending task, zone and inject() in both apps, and onConfigUpdate registers no task. This was rerun with the build-time flag in place, before the NG0205 change and the merge.
• Same apps, the promise branch: getDoc registers and releases its task and resolves with the document, a rejecting wrapped call releases its task and the rejection reaches the caller, the caller's continuation sees the same zone and the same inject() failure as before, and a wrapped call made inside a child EnvironmentInjector that is destroyed before the promise settles resolves.

Backport

Non-breaking. src/zones.ts on 21.1.x is identical to this branch's starting point. A cherry-pick PR against 21.1.x follows at a later date, after a run on an Angular 21 app.