CI: catch tofu and wrong-glyph regressions — check that emitted fonts survive OTS and that the pdf output paints the right glyphs

Start with the test job in .github/workflows/build_test.yml, alongside the existing html-tidy and compare-html steps, and inspect test/scripts/ for how checks are run locally. The proposal calls for OTS validation of emitted font blobs and an allow-listed PDF text comparison; first decide which checks and oracle approach to implement. Done means deterministic CI checks fail on the described regressions and can also be run locally.

Embedded-font regressions in the pdf output have shipped repeatedly and were
always found by eye, never by CI:

• #613 — TrueType subsets without a name table: OTS rejects the font, the
  @font-face is dropped, every PUA glyph renders as tofu.
• #660 — three at once: a CFF Name INDEX holding a space makes OTS discard
  the table; passing OpenType Layout / device-metric tables through verbatim
  makes one malformed table reject the whole font; and a leaked PUA cmap made
  the second output of a document paint whole runs with the wrong glyphs.
• #702 — subset producers name glyphs gidNNNNN, which no glyph list
  translates, so those runs fell through to code-as-GID and painted unrelated
  glyphs.
• #749, #752, #753 — the same family of "the text is there, it just isn't the
  right shapes / isn't where it should be".

Two distinct failure modes, both invisible to the current pipeline:

1. The browser refuses the font. font_is_usable
   (src/odr/internal/html/pdf_file.cpp:2773) only probes that our own encode
   path does not throw. Whether OTS — the sanitizer in every browser, far
   stricter than FreeType or fontTools — accepts the bytes we then emit is
   never checked anywhere.
2. The font loads but paints the wrong glyphs. Nothing compares the shapes
   actually painted against what the page says the text is.

build-test does render the corpus, but the comparison is against
test/data/reference-output, which is regenerated wholesale from our own
output — a bug that is already in the reference is invisible, and #660 in fact
sat there. The pdf views also screenshot nondeterministically (a control run
flaps ~1/60 files), so a genuine small regression is easy to wave off as noise.

Proposal

Two cheap, deterministic checks. Neither needs the reference output, so neither
can be papered over by regenerating it.

1. Every emitted font must survive OTS

After odr_test writes build/test/output/**, extract every
data:font/...;base64 blob from the generated html and run ots-sanitize over
it (pip install opentype-sanitizer ships the binary; it is what I reach for
by hand every time one of these lands). Any ERROR fails the job, and the
message names the exact rejection reason.

This is seconds of runtime, no browser, no flakiness, and it catches #613 and
two thirds of #660 directly.

Worth considering as the stronger version: pull ots in as a test-only conan
dependency and assert it inside odr_test, over the corpus in
test/src/internal/font/. That turns it into a unit-level guard on
SfntFont::write / cff::wrap_to_otf rather than a post-pass over html, and
it fails on the developer's machine before the push.

2. The glyphs painted must be the glyphs meant

For the pdf corpus, take the text an oracle extracts from the source pdf
(gs -sDEVICE=txtwrite, or pdftotext) and compare it against the text of the
generated html, normalised for whitespace. That is the check that would have
caught the PUA-cmap leak in #660 and the gidNNNNN fallthrough in #702: the
page still renders, the layout is unchanged, only the shapes are wrong — and
because we re-encode to the PUA, the html's text is the thing that stays
correct while the glyphs drift, so a text-level oracle sees the divergence the
screenshot comparison shrugs at.

Start with a small allow-listed set of pdf files with a stable expected text,
rather than the whole corpus, so the check is meaningful before it is complete.

A cheaper complement, if the browser is already up: assert in-page that
document.fonts reports every declared face loaded and that no run measures
at the fallback's advance — that catches "the font was dropped" from the other
side, without an oracle.

Where it goes

test job in .github/workflows/build_test.yml, next to the existing
html-tidy / compare-html steps, and mirrored in a script under
test/scripts/ so it is runnable locally the same way.