Robustness: VectorCraft never crashes — no panics in shipped code

Shipped code no longer unwraps, expects or panics: every one of the 124
unwrap()/expect()/panic!/unreachable! sites outside tests now handles the
failure (Result/Option, ?, let-else, defaults) and reports errors to the user.

- Lints: workspace clippy denies unwrap_used, expect_used, panic, todo,
  unimplemented and unreachable; clippy.toml allows them in tests, and
  integration tests, examples and testkit opt out explicitly.
- Safety net (vectorcraft_engine::guard): a panic in a top-level command rolls
  the document back and returns EngineError::Internal; a panicking tool is
  reset; the MCP server answers with an internal error and keeps serving; the
  UI frame and each control request are guarded.
- APIs that hid failures now return them: Rendered::to_png/to_jpeg/to_webp
  return Result (JPEG/WebP errors used to write empty files),
  FontDb::face returns Option, Region::top returns Option.
- Fuzzing: engine/tests/import_fuzz.rs feeds garbage, hostile and mutated SVG
  and PDF through import → render → export (30k cases locally, no panics).
- Docs: AGENTS.md/CLAUDE.md rule, docs/development.md "Robustness" section,
  README pointer and a PR template checklist.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

crates/engine/src/tests.rs

@@ -481,3 +481,32 @@ fn shaper_turns_rough_strokes_into_live_shapes_and_scribbles_delete() {
     stroke(&mut s, &zig);
     assert!(s.doc().unwrap().doc.node(id).is_none());
 }
+
+#[test]
+fn a_panicking_command_rolls_back_instead_of_crashing() {
+    let mut s = session();
+    let a = rect(&mut s, 10.0, 10.0, 100.0, 50.0);
+    let before = s.doc().unwrap().doc.clone();
+    let undo_steps = s.doc().unwrap().history.undo.len();
+    // A bug halfway through a command: the document was already changed in place, inside a
+    // nested command.
+    let r = s.run_guarded("test.panic", |s| {
+        let st = s.doc_mut()?;
+        Arc::make_mut(&mut st.doc).remove(a)?;
+        st.selection = Selection::default();
+        s.run_nested(|_| panic!("boom"))
+    });
+    match r {
+        Err(EngineError::Internal { cmd, msg }) => assert_eq!((cmd.as_str(), msg.as_str()), ("test.panic", "boom")),
+        other => panic!("expected an internal error, got {other:?}"),
+    }
+    let st = s.doc().unwrap();
+    assert!(Arc::ptr_eq(&st.doc, &before), "document rolled back");
+    assert_eq!(st.selection.objects, vec![a]);
+    assert_eq!(st.history.undo.len(), undo_steps);
+    assert_eq!(s.depth, 0);
+    // The session keeps working (and journaling top-level commands).
+    let b = rect(&mut s, 200.0, 10.0, 50.0, 50.0);
+    assert!(s.doc().unwrap().doc.node(b).is_some());
+    assert_eq!(s.journal.last().map(|j| j.0.as_str()), Some("shape.rectangle"));
+}