Answer a curated font substitution before building the metadata tier, and stop preloading theme script fonts

[ikashapov]

Answer a curated font substitution before building the metadata tier, and stop preloading theme script fonts

Refs #188 — the conversion-time half. The GIL half landed earlier (py.detach in src/lib.rs).

What was slow

A document set in Arial converts in 0.57 s with Arial installed and 44 s with it hidden from fontconfig; peak RSS 50 MB → 297 MB. The cost is not the per-glyph fallback pass — its (face, codepoint) memo is sound and it never asks the host when the substitute covers the text. It is the catalogue's deep tier: the first request for a name the host lacks as a family reaches step 4 of the resolver, which builds tier 2 by instantiating every face on the host and reading four tables from each. On CoreText that is 44 ms. On fontconfig/FreeType every new_typeface is an FT_Open_Face with an mmap, enumerate walks every font on the host per family, and the manager retains up to 1024 opened faces — seconds and hundreds of megabytes, proportional to the host's font count rather than to the document. Only after that scan did step 7 consult the table that answers "Arial → Liberation Sans".

Two things made every Word document pay, not just Arial ones: preload resolved four style variants of every family the document names, and collect_font_families added every per-script font a theme lists — thirty-odd families (宋体, Nyala, Tunga, Vrinda…) that no run can ever request, every one absent on a Linux desktop.

Changes

1. Step 3b — a substitution-table key whose own family the host lacks is answered from the table before any metadata is read. The guard keeps the metadata path for keys whose base family is present ("Segoe UI Light" with Segoe UI installed still looks for the real Light face). What the shortcut gives up is a face carrying the key only as a typographic or localized alias (Arial Narrow for "Arial"); for a request by family name the metric substitute is the better answer, and the resolver's step table now says so.
2. family_faces remembers what the manager said about a name it did not enumerate, both ways — each absent family was probed four times, and a matchable unenumerated one gained a duplicate slot per probe that the deep tier then read as well.
3. host_default is fetched once per effective style instead of once per unresolvable family per variant.
4. Theme per-script fonts are no longer preloaded. resolve_theme_font_ref maps only the latin / east-asian / complex-script slots, so none of them served a run; a theme font a run does use still resolves lazily through FontCache::get. Output is unchanged; the document stops warning about fonts it never asked for.
5. The resolver logs which request first reached the metadata tier, and catalog.rs's module doc states that its cost table was measured on CoreText and what the same operations cost on fontconfig.

Evidence

Reproduced in miniature on macOS (debug build, relative numbers): a copy of a five-page document in which every family resolves spends 14–23 ms in the registry; the same document with only its body font absent builds the deep tier (848 faces, 370–480 ms) and doubles wall time, with layout, subsetting and painting unchanged and zero fallback lookups. The Linux magnitude is inferred from Skia's fontconfig port (SkFontMgr_fontconfig.cpp: createTypefaceFromFcPattern, FontAccessible, the 1024-face fTFCache); the reporter's RUST_LOG=debug run before and after — the [font] catalogue deep tier: N faces … line — is the confirmation this PR asks for.

A document naming an absent family that is not a substitution-table key still builds the tier once; bounding that (the typeface-cache limit during the scan) needs a Linux measurement first and is deliberately not in this PR.

Tests

Each watched fail first, with a mutation check:

• a_table_key_whose_family_is_absent_substitutes_without_the_metadata_tier — "Calibri" with only Carlito installed → Substitution, and deep_is_built() stays false (restoring the old order builds it).
• a_table_key_whose_base_family_is_present_still_reaches_the_metadata_tier — "Segoe UI Light" with Segoe UI → ParsedFaceName, tier built (dropping the guard turns it into a substitution).
• an_unenumerable_name_is_probed_once, the_host_default_is_fetched_once_per_style — the two memos, via counters.
• theme_script_fonts_are_not_preloaded.
• FaceCatalog::from_faces_without_deep_tier is the test-support constructor that makes "did this request reach the tier" observable at all; from_faces pre-builds it.