Harden \stgroup and tighten the callout budget (review follow-up)

- Bracket ink is part of the fit: \st@facebody drops -inkw/-inke extreme
  coordinates and \stface/\ststack register them with the enclosing
  group/col/row fit, so a group outline can no longer be crossed by a
  member's bracket arms
- \stlink inside \stgroup or \stcol is now a package error: sub-flow
  members never terminate a pending connector, so the arrow was dropped
  silently while the label still rendered
- \stgroup requires role= (explicit role=neutral for mixed groups) and
  must bind at least two members or one \stcol partition; a lone stack
  or face inside a group is a dirty-build warning
- lint: default budget is one \stcallout per figure; the
  allow-multiple-callouts directive relaxes it to one per band
- build.sh: clean-build hint no longer names hue budget (lint owns it)
- tests/group-callout.tex reworked: multi-member group with a bracketed
  member as a regression probe, single callout; new negative fixtures
  group-link, group-norole, group-single, callout-budget
- api.md, checklist.md, style.md, layout.md, SKILL.md updated to match

references/layout.md

@@ -74,8 +74,8 @@ or on a `\stcallout` card hanging off the right edge of a band. Never drop a flo
 commentary card between two operands unless it is a real operation node (`st comm`).
 
 `\stcallout` is that rule made structural: it refuses to open inside a band, the linter
-rejects it unless it is anchored to a `\strow` name, and a second card on one band is an
-error — side-by-side cards are a dashboard, not a figure. A card that ends up much taller
+rejects it unless it is anchored to a `\strow` name, and a second card in the figure is an
+error without an explicit exemption — a card per band is a dashboard, not a figure. A card that ends up much taller
 than its band is telling you the same thing the overflow warning does: that text is not an
 aside, it is the **Mechanism** row of `\stmeaningbox`.