feat(diagram-engine): open shape vocabulary — catalog + pass-through, structured style merge

The expressiveness gap traced to vocabulary: draw.io has hundreds of shapes,
the declarative layer allowed six. Opening it, with the failure modes from
design review handled:

- shapes.ts: a ~20-entry curated catalog (full style fragment incl. the
  matching perimeter — required or edges connect to the bounding box; a
  text-scale factor verified in the real editor — the same sentence overflows
  a 1.0x rhombus and fits a 1.5x one; labelOutside+glyph for umlActor-style
  figures). Any other token passes through verbatim: draw.io degrades unknown
  shapes to rectangles safely (verified). Injection-capable tokens (;/=) are
  rejected outright.
- Pass-through emits a WARNING with a nearest-catalog hint (bounded edit
  distance), so a typo'd 'cyclinder' is a one-turn fix instead of a silently
  rectangular node forever. set_shape/set_role/set_group operations make the
  fix possible without remove+re-add (which would drop links).
- mergeStyle(): style fragments merge per-key (later wins, bare shape classes
  displace each other) instead of string concatenation. This is what makes
  shape and theme composable by rule — shape owns geometry keys, theme owns
  colour/type keys, and an overlap resolves by order instead of emitting
  contradictory duplicates.
- dai_shape marker carries the declared token through the round trip:
  appearance-based reverse mapping cannot distinguish aliases (diamond vs
  decision) or a rotated queue from a cylinder.
- dai_auto marker separates engine-measured size from user-fixed size: parsed
  boxes no longer freeze the first layout's numbers, so changing a label
  re-measures. Pinned nodes keep everything, as before.
- draw_graph's closed shape enum opened to match (first instance of the
  schema-drift problem the review predicted).

14 new tests: merge ownership, injection rejection, near-match hints,
alias-preserving round trip, re-measure on label change, mxgraph.* tokens
staying boxes with role/group intact. 556 unit tests green; acceptance
diagram (person/hexagon/cylinder/queue/cloud/decision/callout) verified in
the real editor.

lib/diagram-engine/index.ts

@@ -25,7 +25,8 @@ import {
 } from "./operations"
 import { parseDiagram } from "./parse"
 import { renderDiagram } from "./render"
-import type { DiagramTree } from "./types"
+import { nearestShape, resolveShape } from "./shapes"
+import { type DiagramTree, walkTree } from "./types"
 
 export interface RestructureResult {
     /** New canvas XML, or null when the request could not be carried out. */
@@ -85,6 +86,24 @@ export function restructureDiagram(
         )
     }
 
+    // Shape tokens: an injection-capable token is an error; an unknown-but-safe one
+    // passes through (draw.io degrades it to a rectangle) but gets a warning, so a typo
+    // is a one-turn fix instead of a silently rectangular "cyclinder" forever.
+    for (const n of walkTree(applied.tree)) {
+        if (n.kind !== "box" || !n.shape || n.shape === "box") continue
+        const resolved = resolveShape(n.shape)
+        if (!resolved) {
+            errors.push(
+                `shape "${n.shape}" (node ${n.id}) contains characters that are not allowed in a shape token.`,
+            )
+        } else if (resolved.passthrough) {
+            const near = nearestShape(n.shape)
+            warnings.push(
+                `shape "${n.shape}" (node ${n.id}) is not in the engine's catalog — passed through to draw.io, which renders unknown shapes as rectangles.${near ? ` Did you mean "${near}"?` : ""}`,
+            )
+        }
+    }
+
     if (errors.length > 0)
         return { xml: null, outline: outline(applied.tree), errors, warnings }