feat(layout): let a feature draw from geometry the layout has already resolved

[DemchaAV]

First of two. This is the engine seam alone; the Timeline rework that motivated it lands
separately on top, and no Timeline file is touched here.

Why

Some things cannot be drawn while laying out because they depend on where other things
ended up — a rail running between markers, a bracket spanning sections, a leader joining a
callout to its subject. Nothing carries that back. NodeDefinition.emitFragments and
emitOverlayFragments receive only the node's own PreparedNode, FragmentContext and
FragmentPlacement; the positions its children resolved to go straight into the compiler's
fragments/nodes lists, and CompilerState is package-private.

Measured before designing anything: PlacedNode boxes and PlacedFragment boxes share one
coordinate space — bottom-left origin, y growing up — so a pass over the finished graph
needs no conversion.

What changed

• ResolvedLayoutPass runs after compilation, over a finished LayoutGraph plus the
  anchors collected from it, and may only add fragments — never remove, reorder,
  mutate, add pages or touch the canvas.
• LayoutAnchorNode wraps a subtree and emits one non-visual fragment saying where it
  landed. It measures to its child rather than to the width it is offered, which is what
  makes the anchor the marker's box rather than its container's.
• The anchor is the wrapped node's border box — its own margin excluded, its padding
  included. Two boxes are in play: prepare has to measure the child's margin box or the
  surrounding flow is wrong, so emitFragments takes the margin back off, in the offset as
  well as the size. Reporting the margin box would put a marker's anchor centre off its own
  ink — 2pt in both directions for margin(top 2, right 4, bottom 6, left 8) — and a rail
  drawn through that centre would visibly miss.
• LayoutAnchorId compares groupKey and kind with ==. No path, node name or
  string convention is involved — paths are the compiler's business and it renames them
  freely (LayoutCompiler.pathFor uses the node kind as the segment of an unnamed node).
  It refuses a String or a boxed number for the same reason it uses ==.
• ResolvedLayoutPasses splices [under-body…, body…, over-body…] and runs before the
  page backgrounds. Order is not arbitrary: backgrounds prepend and zones append, so passes
  first gives background < pass-under < body < pass-over < zone chrome with no index
  arithmetic. A pass running after backgrounds would have its under-body fragment pushed to
  index 0, beneath an opaque fill, and never seen.
• Two no-op render handlers, pdf and pptx, plus a PptxClipSafety entry. They draw
  nothing and exist because handlerFor throws on a payload class it does not know. Both
  are package-private, beside their backend rather than in the handlers package —
  whose members are public because a caller can register them, which is not true of a
  handler for an internal payload.
• The compiler, the resolver and CompositeDecoration are not touched.

Verification

./mvnw -B -ntp clean verify -pl :graph-compose-core,:graph-compose-render-pdf,:graph-compose-render-docx,:graph-compose-render-pptx,:graph-compose-templates,:graph-compose-testing,:graph-compose-qa,:graph-compose-coverage -am
→ BUILD SUCCESS, 10 modules. 25 tests — 19 in ResolvedLayoutPassTest, 3 in
LayoutAnchorRendersNothingTest, 3 in ResolvedLayoutSeamStaysInternalTest.
javadoc:javadoc green; every knowledge gate green (surfaces current, stability doc,
classifier, claims, routes, bundle verify).

The zero-pass claim is asserted by reference, not by comparison. apply(graph, List.of())
must return the same object. An earlier version of that test compiled the same document
twice and compared the two graphs — which would have passed just as well if apply dropped
a fragment from both. That is the one assertion a consistent corruption cannot satisfy.

The anchor box is asserted where each naive form is known to be wrong. A bare 8×8
ellipse in a table cell reports a 16×8 fragment — the cell's; wrapped, the anchor reports
8×8 at the ellipse's own x. A marker carrying an asymmetric margin reports the ink, not the
ink plus its spacing. A composed marker — three concentric dots in a layer stack, which the
compiler emits as three separate ellipse fragments — reports one anchor at the declared
16×16 box, and its centre is the centre of the marker rather than of whichever shape drew
first. Anchor a container instead and the container is what comes back, which is the whole
of the rule: you get the box of the node you wrapped.

Both backends are asked at render time, not at registration. A handler is one line in a
list and deleting it breaks no compile, so LayoutAnchorRendersNothingTest renders a
document containing an anchor through each fixed backend and compares it to the same
document without the wrapper — the PDF page pixel for pixel, the deck by shape count.
Removing either handler from its defaultHandlers() turns it red with
UnsupportedNodeCapabilityException, checked by doing it.

The owner reaches the pass by reference, carrying its own configuration. That is the
shape a built-in feature needs and the reason nothing has to be registered from the DSL:
one object per logical instance, the feature's settings hanging off it, every anchor keyed
on it. Asserted through the resolver's recompiling path — per-page margins put the document
on the fixed point, so emitFragments builds fresh payloads on each pass while the id they
carry comes from the semantic node, allocated once. A pass asking for an owner the document
does not contain gets an empty list, which is how it decides it has nothing to do.

Making registerLayoutPass public turns the guard red, and so does making either
handler public — checked by doing both and watching
ResolvedLayoutSeamStaysInternalTest fail, not by reasoning about it.

Notes

• An anchored subtree that spans pages reports one anchor per page, sharing an id and
  each carrying the subtree's whole height rather than the slice on that page. A composite
  emits its fragments once per page it occupies. Small atomic content — what anchors are
  for — never reaches this, and fixing it for a consumer that does not exist would be
  speculative, so it is pinned by a test and stated in the Javadoc instead.
• The seam is internal, and adds nothing at all to the public API. Opening it would
  mean settling when passes run, in what order, what one sees of another, whether one may
  change nodes or add pages, resolver re-entry, a second layoutGraph() call, thread
  safety, determinism, duplicate ids, anchor lifecycle, pass failure and backend semantics
  — none of which the built-in case needs answered.

Lane: shared-engine — document.layout, the compiler's post-compilation splice chain,
and one handler per fixed backend.