feat(fonts): add local-first reproducible font assets

[szmyty]

Summary

• add the versioned renderflow.font-registry/v1 contract for pinned local font assets, provenance, SPDX licensing, redistribution/embedding policy, declared Unicode ranges, and semantic typography roles
• resolve ordered target-aware fallbacks with structured rejection/fallback diagnostics and path-independent cache/artifact evidence
• integrate registered fonts with HTML resource embedding, EPUB font/CSS embedding, and the shared LaTeX/Tectonic typography variables
• add renderflow font validate|resolve|css, a redistribution-safe synthetic contract fixture, canonical planning fixture, and end-to-end usage/acquisition documentation
• keep acquisition outside rendering: normal builds never download fonts and the core package does not bundle an unbounded catalog

Design notes

• semantic roles are body, heading, display, monospace, caption, and math
• registry and font SHA-256 identities participate in cache identity
• selected asset IDs, digests, licenses, provenance, and fallback indices are attached as path-independent artifact evidence
• HTML output uses generated local @font-face CSS plus Pandoc resource embedding
• EPUB receives explicit local --epub-embed-font inputs
• PDF/LaTeX accepts only TTF/OTF through the current fontspec integration
• DOCX resolution is validated and recorded; reference-document typography remains authoritative

Focused verification

• changed Rust files formatted with rustfmt --edition 2021
• cargo check --workspace --locked
• cargo clippy --workspace --lib --bins --all-features --locked -- -D warnings -A clippy::too_many_arguments
• 11 font-focused tests passed
• 50 strategy-focused tests passed; 4 existing external-tool tests remained ignored
• registry JSON Schema parsed as Draft 2020-12 and the YAML fixture passed strict runtime validation
• canonical font fixture passed renderflow spec validate and build dry-run planning
• real local Pandoc HTML smoke build embedded the font as data:font/woff2 with no runtime font URL
• git diff --check

Deferred for this sprint

The full test suite and GitHub Actions were intentionally deferred per the current speed-run convention. Tectonic, EPUBCheck, and MkDocs are unavailable in this environment, so their provider-specific integration checks were not run.

Closes #380

Follow-up magazine DNA/AI integration is tracked in #400.

[devactivity-app]

Pull Request Summary by devActivity

Metrics

Achievements

• @szmyty
  Earned XP: 10⭐
  Check Your Progress