approve x/image and re-cost the core ceiling

ADR-0040 puts the dependency approval on the record, as hard rule 2 requires: the
standard library decodes JPEG, PNG and GIF but cannot resize, and image/draw
scales only by nearest neighbour, which is visibly wrong on the photographic
downscales this site is made of. Four modules against a cap of six, no transitive
dependencies, and WebP decoding comes along. AVIF still has no decoder anywhere,
so it will pass through untouched.

ADR-0041 raises CORE_LOC_MAX 2000 → 2800. The old figure was costed before any
code existed, for the spine and the render path, and never budgeted what cmd/ will
hold: `check` ~250, `new` ~100, `-dev` ~100, change detection ~100, page cache
~200. On a core already at 1870 that is ~2620 before anything optional, so the gate
was going to fail work nobody would call excess. A costing error corrected, not
discipline loosened.

The ADR and HARNESS.md both say what a *second* raise would mean: that something
belongs in internal/ext/. Two ceilings exist so "core stops growing, ext rises" is
observable, and that stops being true the moment leaves are let into core.

docs/decisions.md

@@ -519,3 +519,34 @@ stated wherever a key is documented; and the set of keys must stay declared or `
 config, which is the failure the parked cascade already warns about.
 Revisit if: a section wants to set a policy for everything beneath it. That is the parked cascade arriving
 for real, and its trigger is unchanged: the first section-level override with a reader.
+
+## ADR-0040 — `golang.org/x/image` for resampling and WebP decoding
+Date: 2026-07-30 · Status: accepted (human approval on the record, per hard rule 2)
+Decision: add `golang.org/x/image` to the allowlist, for `draw` (CatmullRom resampling) and `webp` (decode).
+Total modules go from three to four, against a cap of six.
+Why: the standard library decodes and encodes JPEG, PNG and GIF but cannot resize — `image/draw` scales only
+by nearest neighbour, which is visibly wrong on photographic downscales, and a site whose content *is*
+pictures cannot ship that. A hand-rolled box filter is about fifty lines and still worse than CatmullRom on
+exactly the material this site has. `x/image` is maintained by the Go team, sibling of the `x/text` already
+allowed, and carries no transitive dependencies.
+Consequence: cheap — good downscaling and WebP input for one module. Expensive — AVIF still has no decoder in
+either the standard library or this module, so AVIF passes through untouched; and image code now has a
+dependency that must be checked at each Go release like any other.
+Revisit if: the standard library gains a resampler, or AVIF becomes something the site actually publishes.
+
+## ADR-0041 — `CORE_LOC_MAX` 2000 → 2800
+Date: 2026-07-30 · Status: accepted
+Decision: raise `CORE_LOC_MAX` from **2000** to **2800**. `EXT_LOC_MAX` stays at 2000. The budget continues
+to cover `cmd/` plus `internal/{content,render,web}`.
+Why: the original figure was costed before any code existed, for "spine, bundles, queries, render, routing,
+templates" — and it never budgeted the things `cmd/` will hold. Costing what remains that cannot be a leaf:
+`check` ~250, `new` ~100, `-dev` ~100, change detection ~100, the page cache ~200. On top of 1870 that is
+~2620 before anything optional, so the ceiling was going to fail on work nobody would call excess. This is a
+costing error being corrected, not discipline being loosened.
+Consequence: cheap — the gate stops blocking planned core work, and 2800 still binds at roughly one feature's
+slack. Expensive — a raised ceiling is a weaker signal than the one it replaces, so the *second* raise should
+be treated as evidence that something belongs in `internal/ext/` instead. Features that are leaves must keep
+going there: if they land in core, `EXT_LOC` measures nothing and invariant 9 becomes unobservable, which is
+the whole reason there are two ceilings.
+Revisit if: core approaches 2800. That is the question "what here is not core?" and the answer is a leaf, not
+a third raise.