fix: stop twelve wrapped calls from holding the app unstable - #3827

Fixes #3826

• Adds blockUntilFirst: false entries to tools/build.ts for eleven callback-taking calls whose first callback a normal load may never run.
• Moves the isSupported entry zone log verbosity #3613 meant for firebase/remote-config into the block that exports it.
• Regenerates the five affected files.

Checklist

• Issue number for this PR: Eleven wrapped callbacks and remote-config isSupported hold the app unstable until something that may never happen #3826
• Docs included?: no. A follow-up documents, for every re-exported function, whether it holds the app unstable, and corrects the sentence in docs/zones.md that says callback APIs do.
• Test units included?: yes, see Verification.
• Breaking change?: no
• In a clean directory, yarn install, yarn test run successfully?: yes, with npm: npm ci, npm run build, npm run build:jasmine, npm run test:node, npm run test:chrome-headless, npm run lint.

Changes

The mechanism:

• ɵzoneWrap registers a pending task when a wrapped call is passed a callback.
• It releases the task when that callback first runs or the returned unsubscribe is called.
• Until then ApplicationRef.isStable is false: an SSR build's route extraction times out after 30 seconds (the beforeAuthStateChanged imported from @angular/fire/auth makes ng build fail during route extraction #3748 failure), and anything waiting on stability in the browser waits with it.

The eleven calls whose first callback is not guaranteed, now { blockUntilFirst: false, logLevel: LogLevel.WARN }:

• onLog: never stable until some Firebase SDK logs. It returns void, so no unsubscribe can release the task either.
• onTokenChanged: never stable until a token is obtained, which a first visit with no auto refresh and no protected request never asks for.
• onChildAdded: never stable on an empty node. A new listener's initial events are only child_added, one per existing child, and value.
• onChildChanged, onChildMoved, onChildRemoved: never stable until someone changes, moves or removes a child. None fires on attach.
• off(query, eventType, callback): never stable. It never calls the callback it is given and returns void.
• enableLogging(fn): never stable until the database SDK logs something.
• fromRef on a child event, stateChanges and auditTrail (rxfire, default events): never stable on an empty node, since they emit only on child events.
• Keeping logLevel: LogLevel.WARN means only the pending task changes: callbacks are still re-entered into the zone and the injection context, and a call outside an injection context still prints its per-function line at the warning level.

isSupported in @angular/fire/remote-config, now { blockUntilFirst: false }:

• With true, every call in a browser with IndexedDB held a pending task until the indexedDB.open it awaits answered, and for good in a browser that never answers.
• zone log verbosity #3613 added isSupported: { blockUntilFirst: false } for it, matching the analytics and messaging entries, but in the rxfire/remote-config block, which exports no isSupported. Overrides match by name, so it did nothing.
• build: classify the firebase symbols a version raise would newly wrap #3759 added the check that fails the build on such an entry, deleted this one and deferred the move.

What callers can notice

• A server render no longer waits for the first batch of onChildAdded children, so the server HTML of a list filled that way can ship before they arrive (reasoned from the wrapper, not run).
• onValue, object and list deliver a value on attach, empty node or not, and still hold the render.
• off(ref, eventType, callback) no longer holds the app, but it still detaches nothing, because the wrapper replaces the callback with its own closure before the SDK compares callback identities.
• The unsubscribe returned by onValue and onChild* is the supported way to detach.
• Code that awaits ApplicationRef.whenStable() before chained Remote Config work no longer waits for isSupported.
• Inside isSupported's .then, inject() throws and the zone is the one that attached the .then, at both flag values, so the callback sees no difference.
• isSupported outside an injection context now logs its per-call line only at the verbose level, as the analytics and messaging copies do.

Verification

• Measured in Chrome on a zone.js Angular 22 app and a zoneless one, against the Database and Firestore emulators.
• Each run recorded every ApplicationRef.isStable emission and counted PendingTasks.add calls.
• At true, the never-firing cases above registered a task that was never released.
• At true, onChildAdded on a populated node, onValue, onSnapshotsInSync and onTokenChanged with auto refresh on released theirs within 2 to 23 ms, and onChildChanged released as soon as a child was written.
• At false, no task was registered in any run, and inside every callback that ran inject() worked and, under zone.js, NgZone.isInAngularZone() was true.
• A fresh Angular 22 SSR app with onLog in provideAppInitializer: ng build fails at the route extractor's 30-second timeout with Routes extraction was aborted when onLog comes from @angular/fire/app, and builds in about 2 s from firebase/app.
• isSupported at true holds the app unstable until the IndexedDB check answers, tens of milliseconds in Chrome, and for the whole window when indexedDB.open is stubbed to never fire. At false it registers no task.
• Specs: 15 new in src/app/app.spec.ts, src/app-check/app-check.spec.ts and src/database/database.spec.ts, and 1 in src/remote-config/remote-config.spec.ts. Each asserts the call registers no pending task.
• The app, app-check and database spec files each have a positive control proving the spy sees the wrapper's registrations.
• Dropping onLog, onChildChanged, fromRef or isSupported from tools/build.ts and rebuilding fails the matching spec.
• npm run build regenerates with the unrecognized-override check passing, and npm run test:node, npm run test:chrome-headless and npm run lint pass.