approve x/image and re-cost the core ceiling

ADR-0040 puts the dependency approval on the record, as hard rule 2 requires: the
standard library decodes JPEG, PNG and GIF but cannot resize, and image/draw
scales only by nearest neighbour, which is visibly wrong on the photographic
downscales this site is made of. Four modules against a cap of six, no transitive
dependencies, and WebP decoding comes along. AVIF still has no decoder anywhere,
so it will pass through untouched.

ADR-0041 raises CORE_LOC_MAX 2000 → 2800. The old figure was costed before any
code existed, for the spine and the render path, and never budgeted what cmd/ will
hold: `check` ~250, `new` ~100, `-dev` ~100, change detection ~100, page cache
~200. On a core already at 1870 that is ~2620 before anything optional, so the gate
was going to fail work nobody would call excess. A costing error corrected, not
discipline loosened.

The ADR and HARNESS.md both say what a *second* raise would mean: that something
belongs in internal/ext/. Two ceilings exist so "core stops growing, ext rises" is
observable, and that stops being true the moment leaves are let into core.

scripts/allowed-deps.txt

@@ -5,4 +5,5 @@
 
 github.com/yuin/goldmark
 golang.org/x/text          # NFC normalisation (ADR-0015); collation later if earned
+golang.org/x/image         # CatmullRom resampling + WebP decode (ADR-0040); no stdlib resizer exists
 gopkg.in/yaml.v3           # frontmatter + site declaration (ADR-0020)