Add source linter, negative test fixtures, and fallback guidance

- scripts/lint.py: reject raw rectangles, absolute coordinates, hue-budget
  and callout/group/formula-order violations at the source level
- tests/invalid/ + tests/lint-invalid/: negative fixtures proving the
  package and linter reject bad input; test.sh now runs both directions
- references/fallback.md: degraded path when no LaTeX is available
- tests/group-callout.tex: exercise \stgroup and \stcallout
- agents/openai.yaml: agent config
- Docs and .sty updated to match

references/fallback.md

@@ -0,0 +1,18 @@
+# Fallback without LaTeX
+
+Use this path only when `scripts/preflight.sh` exits 2. A fallback is not equivalent to the
+TikZ package: say explicitly that cursor placement, ledger locking, face-data validation,
+caption lanes and package warnings are unavailable.
+
+## Preserve manually
+
+1. Recompute the shape/semantics ledger before drawing.
+2. Use one scale function from symbolic axis names to physical lengths; never size two
+   occurrences of the same axis independently.
+3. Keep scores, indices and masks in distinct grammars; preserve exact zeros and support.
+4. Derive every placement from previous bounding boxes and one gutter constant.
+5. Export SVG plus PNG and inspect both full-size and at 360 px using `checklist.md`.
+
+Prefer SVG for editability. Use matplotlib only when it can emit SVG and the tensor cells
+remain individually inspectable. Do not imitate package compliance in the delivery: name
+the fallback renderer and list any inferred shape, convention or reduced guarantee.