Validate fixed-layout EPUB and publish exact capability evidence

[szmyty]

Summary

• Add bounded, independent native validation of the exact ordered PNG/JPEG fixed-layout EPUB route: ZIP/container and raw central directory, OPF metadata and local manifest, spine/page order, decoded geometry and viewport, cover, navigation/page list, accessibility evidence, and safe XHTML/CSS resources.
• Add ebook inspect --fixed-layout to require this route and --run-manifest FILE to bind inspected bytes and ordered image lineage to a completed run. Distinct structured diagnostics cover malformed/unsafe packages, unsupported routes, stale/corrupt provenance, and optional EPUBCheck provider outcomes.
• Record observed EPUBCheck v5 identity, version, arguments, input/report digests, exit and JSON result separately from native validity. Update the exact capability contract, versioned schemas, CLI documentation, tool catalog, and roadmap handoff.
• Extend synthetic PNG/JPEG generation and adversarial fixture coverage. No real artwork or media was mutated.

Local validation

• Rust 1.98: cargo test --workspace --all-targets --locked --offline --quiet — 1,212 passed, 9 ignored (existing opt-in/provider tests).
• cargo clippy --workspace --all-targets --locked --offline -- -D warnings and cargo fmt --all -- --check — passed.
• cargo test --package renderflow --test golden_conformance --locked --offline --quiet — passed.
• Rust 1.94 MSRV: cargo check --workspace --locked --offline --jobs 4 — passed.
• cargo package --package renderflow --allow-dirty --locked --offline — packaged 167 files and verified.
• mkdocs build --strict, both JSON schema parses, and git diff --check — passed.
• Fake EPUBCheck v5 provider tests cover pass, invalid, unavailable, malformed/mismatched reports, and probe failure. A real EPUBCheck executable and hosted CI were not run.

Handoff

Parent #414 can be reconciled and closed after this review merges, using #417's merge eaf3b98d4236a74ba30b6e40456cbf9757675a76 and this PR's merge/workflow evidence. #419 remains the separate immutable integration-candidate release checkpoint. The published review tree 68d2df152126fda27c0364779294add5a909a2fb matches the locally validated tree.

Closes #418

[devactivity-app]

Pull Request Summary by devActivity

Metrics

Achievements

• @szmyty
  Earned XP: 10⭐
  Check Your Progress