fix: trust the probe for over-budget images; TIFF allowance; build wrapper

Review of the image wave (with empirical reproduction against the
vendored image 0.25) found the budget contract did not hold across
formats: the decoder's Limits reserve checks NATIVE bytes-per-pixel,
so a grayscale/RGB JPEG/PNG/BMP over the RGBA budget decoded anyway
and into_rgba8() then ballooned to up to 4x it — the tab death the
budgets exist to prevent. The probed dimensions already prove an
OverBudget image cannot fit, so it is now refused without decoding,
removing all dependence on per-decoder limit fidelity.

Conversely, image's TIFF codec stacks ~3x scratch buffers on top of
the reserve, so an in-budget TIFF (the flagship GIS scenario) was
refused with a self-contradictory note ('400 MB, over the 512 MB
limit'); the decoder allowance for TIFF is now 3x while tier math
stays on the real budget.

Also: the refusal message saturates instead of overflowing on crafted
headers, the image pick only matches the refusal note naming ITS file
(peek, not drain — other references' notes survive for their own
drains), and the Georgian Supplement range ends at U+2D2F (U+2D30.. is
Tifinagh, which ships no font).

Build tooling: the font files missing from dist was a trunk
finalize_dist failure (Windows file-lock during the dist wipe; staging
had them, the exit code was missed) — not a copy-dir skip; it did not
reproduce in two clean cycles. scripts/build-web.sh is now the
canonical wrapper (MSYS_NO_PATHCONV, trunk, font copy + byte
verification that hard-fails), wired into README, Trunk.toml, and the
Pages workflow.

web/fonts/generate.sh

@@ -56,7 +56,7 @@ sub /tmp/NotoArmenianMerged.ttf "U+0000-024F,U+1E00-1EFF,U+2000-206F,U+0530-058F
 
 dl /tmp/NotoGeorgian.ttf "$RAW/NotoSansGeorgian/hinted/ttf/NotoSansGeorgian-Regular.ttf"
 merge /tmp/NotoGeorgian.ttf /tmp/NotoGeorgianMerged.ttf
-sub /tmp/NotoGeorgianMerged.ttf "U+0000-024F,U+1E00-1EFF,U+2000-206F,U+10A0-10FF,U+1C90-1CBF,U+2D00-2D5F" georgian.ttf
+sub /tmp/NotoGeorgianMerged.ttf "U+0000-024F,U+1E00-1EFF,U+2000-206F,U+10A0-10FF,U+1C90-1CBF,U+2D00-2D2F" georgian.ttf
 
 # CJK comes from the noto-cjk repo (CFF/OTF; ttf-parser reads CFF outlines) and
 # is split by language: Simplified Chinese, Traditional Chinese, Japanese and