Copy the ESM script attribute data when cloning a script component

[mvaligursky]

Description

Hardening, no user-visible bug today.

cloneComponent passed the source component's own _attributeDataMap entry straight into the clone's component data:

const attributes = entity.script._attributeDataMap?.get(scriptName) || { };
for (const key in scriptInstance.__attributes) {
    attributes[key] = scriptInstance.__attributes[key];   // writes into the source's object
}

initializeComponentData then does component._scriptsData = data.scripts, so the clone's _scriptsData ends up holding the very object the source reads its attribute values back from — anything writing through one writes through the other.

Nothing mutates it as things stand: __attributes only exists on ScriptType instances, and those never get an _attributeDataMap entry (create only populates the map for non-ScriptType scripts), so the copy loop is a no-op for exactly the scripts the map holds data for. The two happen to be disjoint, which is what keeps the loop above from writing into the source component. That is a fragile thing to rely on, so copy.

Testing

One test in test/framework/components/script/component.test.mjs, fails on main: the clone's attribute data is a distinct object, and writing to it does not change the source's.

Checklist

• I have read the contributing guidelines
• My code follows the project's coding standards
• This PR focuses on a single change

🤖 Generated with Claude Code

[github-actions]

Build size report

This PR changes the size of the minified bundles.

Bundle	Minified	Gzip	Brotli
playcanvas.min.js	2372.2 KB (+0.0 KB, +0.00%)	609.6 KB —	473.4 KB (−0.0 KB, −0.01%)
playcanvas.min.mjs	2369.6 KB (+0.0 KB, +0.00%)	608.5 KB (−0.0 KB, −0.00%)	472.8 KB (−0.1 KB, −0.02%)

[mvaligursky]

Automated PR review by Codex (GPT-5).

No actionable issues found.

The shallow object copy is at the correct ownership boundary: it prevents the clone's component data from aliasing the source _attributeDataMap entry while preserving the existing value semantics for attribute payloads, which are subsequently interpreted or cloned according to their schemas. The regression test verifies both identity separation and mutation isolation.

Local verification on the exact head: the full focused ScriptComponent suite passed (89 tests), ESLint passed for both changed files, and git diff --check passed. All current GitHub checks are green.