fix(components): stop five painters aborting on schema-valid input

[LeadcodeDev]

Refs #142 — Components workstream.

Five painters aborted or hung on input that rustmotion validate reports as "Valid scenario". A panic inside a painter takes the entire encode with it, so the guard belongs in the painter, not upstream in the schema.

All five reproductions come from the audit and are preserved verbatim as tests. They were run red first: each one reproduced the exact original failure before any fix landed.

Component	Input	Failure observed
shape	stops of a different length than colors	assertion failed: pos.is_none() || (pos.unwrap().len() == colors.len()) in skia's gradient shader
table	"row_colors": []	index out of bounds: the len is 0 but the index is 0
tag_cloud	"colors": []	attempt to calculate the remainder with a divisor of zero
dot_map	"dot_spacing": 0	never returns
codeblock diff	any non-ASCII text	byte index 20 is not a char boundary; it is inside 'ス'

Notes on two of them

dot_map — (w - 0) / 0 is +inf, and inf as u32 saturates to u32::MAX in Rust rather than wrapping, so the nested loop was scheduled for roughly 1.8e19 iterations. The geometry pass catches dot_spacing: 0.01 but not 0, which is why the floor has to live in the painter. The grid is also capped per axis so a legal spacing on a very large box cannot schedule unbounded work either.

codeblock diff — the audit called this a char-boundary slip; it is broader than that. col, delete and insert all counted bytes (String::len), while the reveal interpolates progress * total_work, so a fraction of a byte count lands part-way through a glyph. Snapping offsets to boundaries would stop the panic but leave the real defect: a CJK glyph consumed three reveal steps instead of one. The accounting is now in characters throughout, converted to byte offsets only at slice sites via byte_at. cursor_col moved to the same unit, including its measurement site.

Test design

The new tests/degenerate_inputs.rs drives every case through the real pipeline — serde, build_scene_with_anim, run_layout, paint_tree — mirroring the existing caption_presets.rs harness. Going through serde matters: a fix that guarded the painter while leaving the component undeserialisable would still fail the test.

dot_map paints on a worker thread with a deadline. A runaway loop would otherwise wedge CI rather than report, and a regression test that hangs is not a regression test.

The codeblock case sweeps 21 points across the reveal, because the panic only fires on the frames where progress lands inside a glyph — a single mid-point sample would have missed it.

Out of scope

Tightening the schema so these inputs are rejected up front (stops length, dot_spacing > 0) belongs to the Schema & serde workstream. Making the painters total is the right layer regardless: validate is advisory, and a panic must not be reachable from a deserialisable component.

Verification

cargo fmt --all --check, cargo clippy --workspace --all-targets -- -D warnings, cargo test --workspace (692 passed, 0 failed).