feat: september 26 release

[xames3]

this pr is for September 2026 release.

it's mostly a tidy-up, but a few things that were quietly broken are now not.

• open graph is done properly and without any external dependencies
• dropped sphinxext-opengraph and matplotlib
• kaamiki now spawns only one Jinja environment instead of seven
• most (if not all) of the dead code is out
• six directives had node/visit/depart placeholders that never ran; so handled them
• picture emits real width/height read off the image header, so pages stop shuffling about as images load
• no imaging dependencies now
• repository finally honours :stars: and :forks: by setting defaults as 0 if GitHub doesn't respond
• stylesheets register in an explicit cascade order rather than @import-ing from theme.css, so the browser fetches them in parallel
• geist.css is font.css now, since it carries both faces
• added support for logo and the markup lives in a shared macro instead of being written out twice
• urllib3 unpinned to >=
• mypy --strict and ruff clean across the theme
• per-page :og: fields were being ignored entirely; now working
• roles never escaped anything; they're working
• embed escapes by context now
• incremental builds were skipping post-processing altogether
• make_toc_collapsible inserted its toggle unconditionally, so running twice over the same file stacked up duplicate buttons
• genindex and search get post-processed now as well, instead of shipping the template headers as comments
• the "on this page" rail is gone entirely
• the FontAwesome kit id was hardcoded in the layout, so every kaamiki site was loading my kit off my quota; it's a conf key now
• same for cal.com, which was initialising my quick-chat namespace on every page of every site; it reads the namespaces off the page instead
• the cal.com button attributes had no space between them, and only ever looked right because BeautifulSoup re-normalised the markup on the way out
• dropped the jsdelivr preconnect, mathjax was the only thing using it and it only loads on pages carrying maths
• the CI format job ran ruff format on a throwaway checkout and binned the result, so it could never fail; it checks now
• CI runs on pushes to main too, and clones with full history so the git log date fallback actually works