approve x/image and re-cost the core ceiling

ADR-0040 puts the dependency approval on the record, as hard rule 2 requires: the
standard library decodes JPEG, PNG and GIF but cannot resize, and image/draw
scales only by nearest neighbour, which is visibly wrong on the photographic
downscales this site is made of. Four modules against a cap of six, no transitive
dependencies, and WebP decoding comes along. AVIF still has no decoder anywhere,
so it will pass through untouched.

ADR-0041 raises CORE_LOC_MAX 2000 → 2800. The old figure was costed before any
code existed, for the spine and the render path, and never budgeted what cmd/ will
hold: `check` ~250, `new` ~100, `-dev` ~100, change detection ~100, page cache
~200. On a core already at 1870 that is ~2620 before anything optional, so the gate
was going to fail work nobody would call excess. A costing error corrected, not
discipline loosened.

The ADR and HARNESS.md both say what a *second* raise would mean: that something
belongs in internal/ext/. Two ceilings exist so "core stops growing, ext rises" is
observable, and that stops being true the moment leaves are let into core.

scripts/budgets.env

@@ -5,7 +5,7 @@
 # code worse — sharding a coherent file into a `_helpers.go` turns it green while creating the package
 # CLAUDE.md rule 3.6 bans. Total mass cannot be gamed by moving code between files; file length can.
 
-CORE_LOC_MAX=2000      # cmd/ + internal/{content,render,web} + repo root, non-test .go
+CORE_LOC_MAX=2800      # cmd/ + internal/{content,render,web} + repo root, non-test .go (ADR-0041)
 EXT_LOC_MAX=2000       # internal/ext/ — composition, grows after the core freezes
 FILE_LOC_WARN=500      # any single .go file — advisory
 FUNC_LOC_WARN=60       # any single function — advisory
@@ -13,7 +13,11 @@ DEPS_MAX=6             # total modules in go.mod, direct plus indirect
 
 # Two ceilings because "the core stops growing after Arc 2" (architecture.md invariant 9) is only an
 # invariant if something measures it: post-freeze CORE holds and only EXT rises.
-# Costed, not round: spine, bundles, queries, render, routing, templates ~1200-1800 → CORE 2000.
+# Costed, not round, and re-costed once (ADR-0041): the first figure covered spine, bundles, queries,
+# render, routing and templates (~1200-1800 → 2000) but never budgeted what cmd/ would hold. Adding `check`
+# ~250, `new` ~100, `-dev` ~100, change detection ~100 and the page cache ~200 to a core already at 1870
+# gives ~2620 → CORE 2800. A second raise is evidence something belongs in internal/ext/, not evidence the
+# number is still too small.
 # Feeds, sitemap, OpenGraph, shortcodes, image sizing, galleries, paging, indieweb ~900-1200 → EXT
 # 2000, deliberately loose since that is where growth belongs. Reaching CORE asks what to delete;
 # reaching EXT asks whether a template would have done it — only .go lines count here.