Robustness: VectorCraft never crashes — no panics in shipped code

Shipped code no longer unwraps, expects or panics: every one of the 124
unwrap()/expect()/panic!/unreachable! sites outside tests now handles the
failure (Result/Option, ?, let-else, defaults) and reports errors to the user.

- Lints: workspace clippy denies unwrap_used, expect_used, panic, todo,
  unimplemented and unreachable; clippy.toml allows them in tests, and
  integration tests, examples and testkit opt out explicitly.
- Safety net (vectorcraft_engine::guard): a panic in a top-level command rolls
  the document back and returns EngineError::Internal; a panicking tool is
  reset; the MCP server answers with an internal error and keeps serving; the
  UI frame and each control request are guarded.
- APIs that hid failures now return them: Rendered::to_png/to_jpeg/to_webp
  return Result (JPEG/WebP errors used to write empty files),
  FontDb::face returns Option, Region::top returns Option.
- Fuzzing: engine/tests/import_fuzz.rs feeds garbage, hostile and mutated SVG
  and PDF through import → render → export (30k cases locally, no panics).
- Docs: AGENTS.md/CLAUDE.md rule, docs/development.md "Robustness" section,
  README pointer and a PR template checklist.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

crates/engine/src/cmd/buildcmds.rs

@@ -308,7 +308,7 @@ fn sb_merge(s: &mut Session, p: &Value) -> Result<Value> {
                     new_nodes.push(shape_node(d, rest, Some(leaf)));
                 }
             }
-            if !erase && i == style_src {
+            if !erase && Some(i) == style_src {
                 let mut m = shape_node(d, union.clone(), Some(leaf));
                 if let Some(f) = &fill {
                     m.appearance.set_fill(f.clone());
@@ -399,7 +399,7 @@ fn build_children(d: &mut Document, sources: Vec<Arc<Node>>) -> Result<(Vec<Arc<
     let nfaces = regs.len();
     for r in regs {
         let id = d.alloc_id();
-        let fill = styles[r.top()].0.clone();
+        let fill = r.top().and_then(|t| styles.get(t)).map_or(Paint::None, |s| s.0.clone());
         let mut n = Node::path(id, r.path, fill_only(fill));
         n.name = Some(FACE_NAME.into());
         children.push(Arc::new(n));
@@ -680,7 +680,14 @@ fn trace_make(s: &mut Session, p: &Value, expand: bool) -> Result<Value> {
     let label = if expand { "Image Trace (Make and Expand)" } else { "Image Trace" };
     let id = s.edit(label, |d, sel| {
         let src = d.node(target).cloned().ok_or(EngineError::NoNode(target))?;
-        let mut image = if is_trace_group(&src) { (**src.children().unwrap().first().unwrap()).clone() } else { src.clone() };
+        let mut image = if is_trace_group(&src) {
+            src.children()
+                .and_then(|c| c.first())
+                .map(|c| (**c).clone())
+                .ok_or_else(|| EngineError::Other("Image Trace: the traced image is missing".into()))?
+        } else {
+            src.clone()
+        };
         image.visible = true;
         let mut children: Vec<Arc<Node>> = vec![];
         if !expand {