Generate the documentation's figures from the listings they illustrate

Chapters 6 and 8 described what a verb draws in prose. Eight figures now show
it, and each one is produced by running the BASIC listing printed immediately
above it -- so a picture cannot drift away from the code beside it, which is the
way a screenshot goes wrong and the way nothing notices.

tools/screenshot.c is a second SDL host, much smaller than the frontend: dummy
video driver, software renderer, run to completion, read the target back, write
a PNG. It draws no text layer on purpose, so a READY in the corner is not noise
in a figure about BOX and no font has to be resolved.

tools/docs_screenshots.sh reads the new screenshot=NAME fence tag straight out
of the markdown. size=WxH is the second tag, and SCALE's figure uses it: the
point being made is a 320x200 listing filling a larger window, which cannot be
made on a 320x200 surface.

Two gates, answering different questions. docs_examples fails a tagged block
with no image, in both configurations, so a figure cannot be added and
forgotten. docs_screenshots -- a CTest, AKGL build only -- re-renders every
figure and compares byte for byte, so a listing edited without regenerating
fails. Only the second catches a stale picture.

The PNGs are checked in because a reader on the forge has no build tree, and
docs/images/README.md says loudly that they are generated. Regenerating is never
part of a build: the target is run deliberately, so a make cannot put eight
binary diffs in front of whoever ran it.

Drawing the BOX figure caught a defect in TODO.md itself. Deviation 16 claimed
in bold that BOX fills on a negative angle while its own paragraph said the fill
was filed rather than implemented. BOX cannot fill, and filled_rect is reached
by no verb as a result.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

MAINTENANCE.md

@@ -576,9 +576,42 @@ a missing decision rather than a free pass.
 | `sh norun` | Shown, not run |
 | `cmake` | **Never executed.** Hand-maintained, by decision |
 | `text` | **Never executed.** A block diagram, or a stack trace captured from a real run |
+| `basic screenshot=NAME` | Also the source of `docs/images/NAME.png`. The harness checks the file exists; `tools/docs_screenshots.sh` is what makes it |
+| `basic size=WxH` | That figure's surface, when 320x200 is not the size the point needs |
 
 Attributes combine: `basic requires=akgl setup=ship` is a real tag in `docs/08-sprites.md`.
 
+### Figures are output, not assets
+
+A chapter about `CIRCLE` wants a picture of what `CIRCLE` draws, and the way a picture
+goes wrong is that it stops being of the code beside it — silently, because a screenshot
+taken by hand still looks like a screenshot long after the verb changed. So a figure is
+generated from the listing it illustrates:
+
+```sh norun
+$ cmake --build build-akgl --target docs_screenshots
+```
+
+`tools/screenshot.c` is a second, much smaller SDL host — the dummy video driver, a
+software renderer, run the program to completion, read the target back, write a PNG. It
+draws no text layer, deliberately: a `READY` in the corner is noise in a figure about
+`BOX`, and skipping it means no font has to be found.
+
+Three rules around it:
+
+- **The PNGs are checked in.** A reader on the forge has no build tree. They are generated
+  files that are tracked on purpose, so **do not hand-edit one** — change the listing and
+  regenerate, which is the whole point of the arrangement.
+- **The build never regenerates them.** The target is only ever run deliberately, because a
+  `make` that quietly rewrote eight binaries would put that diff in front of whoever
+  happened to build.
+- **`docs_examples` fails a tagged block with no image**, in both configurations, so a
+  figure cannot be added to a chapter and then forgotten.
+
+`requires=akgl` belongs on a screenshot block too. The two tags answer different questions:
+one is whether the program is *run by the suite*, the other is whether it *produces a
+figure*, and a graphics listing wants both.
+
 `text` exists because `docs/14-architecture.md` needed block diagrams and an untagged block
 is a hard error. It carries no executable claim, which is exactly why it has to be *said*:
 the alternative was an indented code block that the extractor never sees, and a picture