Add source linter, negative test fixtures, and fallback guidance

- scripts/lint.py: reject raw rectangles, absolute coordinates, hue-budget
  and callout/group/formula-order violations at the source level
- tests/invalid/ + tests/lint-invalid/: negative fixtures proving the
  package and linter reject bad input; test.sh now runs both directions
- references/fallback.md: degraded path when no LaTeX is available
- tests/group-callout.tex: exercise \stgroup and \stcallout
- agents/openai.yaml: agent config
- Docs and .sty updated to match

scripts/test.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Build every example and the smoke test. Any dirty build fails the run.
+# Build every valid example, then prove invalid TeX and lint fixtures fail.
 #
 #   ./scripts/test.sh
 #
@@ -21,8 +21,30 @@ for f in "$ROOT"/tests/*.tex "$ROOT"/examples/*.tex; do
   fi
 done
 
+for f in "$ROOT"/tests/invalid/*.tex; do
+  [[ -e "$f" ]] || continue
+  name="$(basename "$f")"
+  if ST_SKIP_LINT=1 "$ROOT/scripts/build.sh" "$f" >/dev/null 2>&1; then
+    echo "  FAIL  $name (invalid fixture built cleanly)"
+    fail=$((fail+1))
+  else
+    echo "  ok    $name (rejected by package/build)"
+  fi
+done
+
+for f in "$ROOT"/tests/lint-invalid/*.tex; do
+  [[ -e "$f" ]] || continue
+  name="$(basename "$f")"
+  if python3 "$ROOT/scripts/lint.py" "$f" >/dev/null 2>&1; then
+    echo "  FAIL  $name (invalid fixture passed lint)"
+    fail=$((fail+1))
+  else
+    echo "  ok    $name (rejected by lint)"
+  fi
+done
+
 if [[ $fail -gt 0 ]]; then
-  echo "$fail failing figure(s); rerun scripts/build.sh on one to see why" >&2
+  echo "$fail failing check(s); rerun the reported build or lint command to inspect" >&2
   exit 1
 fi
-echo "all figures build clean"
+echo "all positive and negative checks passed"