approve x/image and re-cost the core ceiling

ADR-0040 puts the dependency approval on the record, as hard rule 2 requires: the
standard library decodes JPEG, PNG and GIF but cannot resize, and image/draw
scales only by nearest neighbour, which is visibly wrong on the photographic
downscales this site is made of. Four modules against a cap of six, no transitive
dependencies, and WebP decoding comes along. AVIF still has no decoder anywhere,
so it will pass through untouched.

ADR-0041 raises CORE_LOC_MAX 2000 → 2800. The old figure was costed before any
code existed, for the spine and the render path, and never budgeted what cmd/ will
hold: `check` ~250, `new` ~100, `-dev` ~100, change detection ~100, page cache
~200. On a core already at 1870 that is ~2620 before anything optional, so the gate
was going to fail work nobody would call excess. A costing error corrected, not
discipline loosened.

The ADR and HARNESS.md both say what a *second* raise would mean: that something
belongs in internal/ext/. Two ceilings exist so "core stops growing, ext rises" is
observable, and that stops being true the moment leaves are let into core.

HARNESS.md

@@ -52,6 +52,12 @@ must do — not the theme. `verify.sh` fails if the embedded reference theme cha
 changing, because in practice those two drift together — and it fails on a `<script>` tag in that theme,
 because a reference theme that grows taste stops being a reference (ADR-0026).
 
+**The core ceiling moved once, on purpose.** `CORE_LOC_MAX` went 2000 → 2800 (ADR-0041) because the original
+figure was costed before any code existed and never budgeted what `cmd/` would hold — `check`, `new`, `-dev`,
+change detection. Treat a *second* raise as evidence that something belongs in `internal/ext/` instead: the
+two ceilings exist so that "core stops growing, ext rises" is observable, and that stops being true the moment
+leaves are allowed into core.
+
 **What is staged has to build, not just the working tree.** Every other gate looks at your files; this one
 looks at the commit you are about to make, by building a throwaway checkout of the index. It exists because
 staging a subset — a changed signature without its caller — produced a commit that did not compile while