Add source linter, negative test fixtures, and fallback guidance

- scripts/lint.py: reject raw rectangles, absolute coordinates, hue-budget
  and callout/group/formula-order violations at the source level
- tests/invalid/ + tests/lint-invalid/: negative fixtures proving the
  package and linter reject bad input; test.sh now runs both directions
- references/fallback.md: degraded path when no LaTeX is available
- tests/group-callout.tex: exercise \stgroup and \stcallout
- agents/openai.yaml: agent config
- Docs and .sty updated to match

README.md

@@ -14,7 +14,8 @@ SKILL.md              the skill entry point (lean; loads references on demand)
 references/           geometry, semantics, layout, style, api, checklist, antipatterns
 assets/supertensor.sty  the macro package
 scripts/preflight.sh  is the TikZ + CJK path available?
-scripts/build.sh      compile, audit the log, export pdf/svg/png/thumb
+scripts/lint.py       reject source-level invariant escapes
+scripts/build.sh      lint, compile, audit the log, export pdf/svg/png/thumb
 examples/             three golden examples + an anti-pattern gallery
 ```
 
@@ -87,8 +88,11 @@ The flow layout adds two of its own: an object that overflows its band, and a `\
 whose contents do not add up to the height it declared (which means it is drawn
 off-center). Both are things a reader would have to notice for you.
 
-A clean build still proves nothing about collisions, hue budget or whether the math is
-right. That is what `references/checklist.md` is for.
+A clean build now also proves the source avoided untracked absolute objects, ledger
+changes, raw rectangles, unclosed `\stgroup` blocks, side cards anchored to a single face
+or doubled up on one band, and excess per-row hues. It still cannot prove that the math,
+semantics or rendered relationships are right; that is what `references/checklist.md` is
+for.
 
 ## Provenance