Robustness: VectorCraft never crashes — no panics in shipped code

Shipped code no longer unwraps, expects or panics: every one of the 124
unwrap()/expect()/panic!/unreachable! sites outside tests now handles the
failure (Result/Option, ?, let-else, defaults) and reports errors to the user.

- Lints: workspace clippy denies unwrap_used, expect_used, panic, todo,
  unimplemented and unreachable; clippy.toml allows them in tests, and
  integration tests, examples and testkit opt out explicitly.
- Safety net (vectorcraft_engine::guard): a panic in a top-level command rolls
  the document back and returns EngineError::Internal; a panicking tool is
  reset; the MCP server answers with an internal error and keeps serving; the
  UI frame and each control request are guarded.
- APIs that hid failures now return them: Rendered::to_png/to_jpeg/to_webp
  return Result (JPEG/WebP errors used to write empty files),
  FontDb::face returns Option, Region::top returns Option.
- Fuzzing: engine/tests/import_fuzz.rs feeds garbage, hostile and mutated SVG
  and PDF through import → render → export (30k cases locally, no panics).
- Docs: AGENTS.md/CLAUDE.md rule, docs/development.md "Robustness" section,
  README pointer and a PR template checklist.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

crates/text/src/fontdb.rs

@@ -400,21 +400,19 @@ impl FontDb {
     }
 
     /// Resolve a family + style to a face, falling back to the closest style of the family, then to
-    /// Source Sans 3 Regular.
-    pub fn face(&self, family: &str, style: &str) -> Arc<FontFace> {
+    /// Source Sans 3 Regular. `None` only if no font at all is loaded (the bundled fonts failed to
+    /// parse), in which case text has no glyphs.
+    pub fn face(&self, family: &str, style: &str) -> Option<Arc<FontFace>> {
         if let Some(f) = self.find(family, style) {
-            return f;
+            return Some(f);
         }
         #[cfg(not(target_arch = "wasm32"))]
         if self.load_cataloged(family)
             && let Some(f) = self.find(family, style)
         {
-            return f;
+            return Some(f);
         }
-        self.find(FALLBACK_FAMILY, style)
-            .or_else(|| self.find(FALLBACK_FAMILY, "Regular"))
-            .or_else(|| self.read_faces().first().cloned())
-            .expect("bundled fonts are always present")
+        self.find(FALLBACK_FAMILY, style).or_else(|| self.find(FALLBACK_FAMILY, "Regular")).or_else(|| self.read_faces().first().cloned())
     }
 
     /// Is `family` available (loaded)?

crates/text/src/shape.rs

@@ -83,16 +83,17 @@ fn is_cjk(c: char) -> bool {
 
 /// Vertical metrics (points) of a style's resolved face: (ascent, descent, leading).
 pub(crate) fn style_metrics(db: &FontDb, st: &CharStyle) -> (f64, f64, f64) {
-    let face = db.face(&st.font_family, &st.font_style);
-    let k = st.size / face.upem;
     let vs = st.v_scale / 100.0;
+    let Some(face) = db.face(&st.font_family, &st.font_style) else { return (st.size * 0.8 * vs, st.size * 0.2 * vs, st.effective_leading()) };
+    let k = st.size / face.upem;
     (face.ascent * k * vs, face.descent * k * vs, st.effective_leading())
 }
 
 /// Cap height and x height (points) of a style's resolved face.
 pub(crate) fn cap_x_heights(db: &FontDb, st: &CharStyle) -> (f64, f64) {
-    let face = db.face(&st.font_family, &st.font_style);
-    let k = st.size / face.upem * st.v_scale / 100.0;
+    let vs = st.v_scale / 100.0;
+    let Some(face) = db.face(&st.font_family, &st.font_style) else { return (st.size * 0.7 * vs, st.size * 0.5 * vs) };
+    let k = st.size / face.upem * vs;
     (face.cap_height * k, face.x_height * k)
 }
 
@@ -111,7 +112,7 @@ pub(crate) fn shape_range(
         if a >= b {
             continue;
         }
-        let primary = db.face(&st.font_family, &st.font_style);
+        let Some(primary) = db.face(&st.font_family, &st.font_style) else { continue };
         let pmap = primary.skrifa().map(|f| f.charmap());
         // Split into segments by font coverage.
         let mut seg_start = a;

crates/text/src/tests.rs

@@ -47,15 +47,15 @@ fn bundled_families_and_styles() {
 
 #[test]
 fn style_lookup_and_fallback() {
-    let f = db().face("Inter", "Semibold");
+    let f = db().face("Inter", "Semibold").unwrap();
     assert_eq!((f.family.as_str(), f.style.as_str()), ("Inter", "SemiBold"));
-    let f = db().face("inter", "Bold");
+    let f = db().face("inter", "Bold").unwrap();
     assert_eq!(f.style, "SemiBold", "closest weight");
-    let f = db().face("No Such Font", "Regular");
+    let f = db().face("No Such Font", "Regular").unwrap();
     assert_eq!((f.family.as_str(), f.style.as_str()), ("Source Sans 3", "Regular"));
-    let f = db().face("No Such Font", "Bold");
+    let f = db().face("No Such Font", "Bold").unwrap();
     assert_eq!(f.style, "Bold");
-    assert_eq!(db().face("Source Sans 3", "Italic").style, "Italic");
+    assert_eq!(db().face("Source Sans 3", "Italic").unwrap().style, "Italic");
 }
 
 #[test]
@@ -344,7 +344,7 @@ fn on_path_circle_and_overflow() {
 
 #[test]
 fn fallback_font_per_character() {
-    let primary = db().face("Source Sans 3", "Regular");
+    let primary = db().face("Source Sans 3", "Regular").unwrap();
     // Find a character the primary lacks but another bundled font has.
     let c = ['\u{2500}', '\u{2192}', '\u{25B6}', '\u{2588}', '\u{21E5}', '\u{2318}']
         .into_iter()

crates/text/src/tests_typo.rs

@@ -363,7 +363,7 @@ fn opentype_ligature_switches() {
 
 #[test]
 fn face_charmap_for_glyphs_panel() {
-    let f = db().face("Source Sans 3", "Regular");
+    let f = db().face("Source Sans 3", "Regular").unwrap();
     let chars = f.chars();
     assert!(chars.len() > 200, "{}", chars.len());
     assert!(chars.windows(2).all(|w| w[0].0 < w[1].0));