Raise the F06 mesh caps in code and cases - #150

What this changes

F06 section 6 raised the hard mesh caps (decision on #141) so a plate with 64 holes of 1024 sides
fits, but the code still carried the old numbers, so the kernel, the engine blob validator and the
layer-engine budgets refused what the contract now admits. This raises every derived bound to the
contract values and updates the F06 case table:

• Kernel shell/blob caps (crates/kernel/src/trimesh.rs): 262,144 vertices, 524,288 triangles,
  65,535 face-table entries (the u16 face index), 13,631,520-byte blob.
• Extrusion build caps (crates/kernel/src/profile/extrude.rs): the same values plus 786,432
  topological edges and 1,114,111 features.
• G05 profile admission (crates/kernel/src/profile/mod.rs): total profile points 131,072 (half
  the vertex cap; per-contour 1,024 points and 256 cavities unchanged).
• Triangulation work budget (crates/kernel/src/profile/triangulate.rs): 150,000,000 →
  40,000,000,000 exact orientation evaluations. Ear clipping scans the remaining contour per
  candidate, so a cap-size profile costs on the order of n²/2 evaluations; at the old budget a
  profile the new caps admit passed admission and then died with a typed WorkBudget failure.
• Operation production bounds (crates/kernel/src/ops/mod.rs): result triangles 8192 → 524,288;
  cap loops 64 → 257 (256 G05 cavities plus the outer loop), so a 64-hole plate can actually be
  cut or sectioned.
• Engine blob validator constants (crates/engine/src/limits.rs): the new caps.
• Layer-engine model profile (crates/layer-engine/src/lib.rs, plus a dated amendment in
  docs/design/layer-budgets-model-profile.md): array_items 32,768 → 1,572,864 — one derived
  mesh at the caps is 524,288 triangles = 1,572,864 indices per array; without this a legal
  cap-size body could not be derived into a USD layer.
• F06 cases (tests/fixtures/contracts/f06-geometry-contract-cases-v0.1.json): F06-POS-27 and
  F06-NEG-11 to F06-NEG-14 carry the new cap numbers, plus the two derivations that quote the
  blob byte cap.
• G07 bench: adds the cap body (64 round holes of 1020 edges) build/analyze timing and scales the
  near-cap structural-gate slab to the new caps.

The kernel certification capacity is deliberately untouched (GEO_KERNEL_CAPACITY): G06 analysis
of a cap-size body still stops with a typed Uncertain at the default budgets, and the bench
reports that instead of hiding it.

Fixes #147

Body-certification time at the new limits

Release build, macOS (Darwin 27), aarch64, cargo run --release -p beamcraft-kernel --example g07_bench (the harness prints min/median/max over repeated calls). Extrusion time covers
admission, triangulation, build and every self-check: an Extrusion exists only after its volume
certificate passed, so this is the cost of certifying the body, not only of building it.

The 1,020-edge body runs identical code on both sides; the 6.5–12.6 ms spread is machine load
between runs, not a changed path. The new cost is the expected superlinear ear clipping at
cap-size contours; it stays bounded by the work budget, which still refuses pathological contours
with a typed failure instead of hanging.

How you verified it

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets -- -D warnings
• cargo test --workspace — every suite passes except six beamcraft-host output::tests
  cases on this macOS machine; they fail identically on unmodified upstream/master (verified by
  stashing this change and rerunning), match the known macOS symlink/std::env::temp_dir
  environment issue, and touch no code this PR changes.

New behaviour needs a test: the cap-boundary tests were rewritten for the new numbers
(one_above_the_face_cap_is_a_topology_limit and the at-cap refusal in
triangle_cap_is_enforced_before_any_triangulation, both refused after admission and before any
triangulation), the G05 total-points test now sits one contour above the 131,072 cap, the shell
validator's at-cap blob test follows the constants, and the engine validator's at-cap test scales
with them.

Never-crash

Every model file, IFC/DSTV import and keystroke is untrusted input (AGENTS.md §4).

• No new unwrap/expect/panic!/todo! outside tests
• No indexing or slicing with input-derived positions; allocations sized by input are capped
• No unsafe

Provenance

Read AGENTS.md §1 and §2 before adding any asset.

• Nothing taken from Tekla Structures or any Trimble product (assets, code, documentation, tables)
• No GPL/AGPL code copied in
• Every new asset has an entry in ATTRIBUTION.md (no new assets)

Anything a reviewer should look at first

• The triangulation work budget (150 M → 40 G) is the judgement call: it must admit the
  square-of-contour cost of ear clipping at the new caps while keeping the documented
  bounded-refusal property. Measured above: 8.4 s and 35.3 s for the two cap-size bodies; a
  pathological contour still ends in a typed WorkBudget failure, never a hang.
• MAX_TOTAL_MESH_BYTES (64 MiB snapshot retention) and the F05/host wire budgets are unchanged,
  as the contract allows: a delivery limit smaller than a body needs refuses delivery with
  GEO_BUFFER_LIMIT and never fragments a blob.
• The face cap acceptance at exactly 65,535 faces is covered blob-level by the F06-POS-27
  validator cases; a full at-cap kernel build would be a minutes-long 65k-point extrusion in a
  debug test, so the kernel test pins the refusal side (one above the cap) and the success side
  stays covered by the below-cap and blob-level cases.

🤖 Generated with Claude Code