merge(thumbs): thumbnails sized for the tile's width at 2x, and a cache that cannot be planted

Operator-approved 2026-09-23 ("fix it, one bigger thumbnail"), after his
report that sindra-nude-final looked "blurry until selected". c2b1454 sizes
thumbnails at 768 wide (the widest desktop tile, doubled for a 2x screen) and
caps them at 4096 tall. A browser test holds the number against the rendered
grid. c19d8c9 folds the heid bug-hunt (4/4 arms, five seat-executed probes):
cache hits must be regular files carrying the source's exact mtime, the cache
dirs never follow a link, the temp file is mkstemp, palette alpha and EXIF
orientation survive, and there is a 64 MP decode budget. 828 passed on the
branch; thumbs.toml 14/14.

persistent-memory.md

@@ -66,9 +66,25 @@ _As of 2026-09-23:_
   /b/<name>/blurbooth`, and **`booth blur <name>` with NO files fogs the whole
   booth**. COMPOSES with `.blurred`, never overrides. All 17 handles can
   self-blur at post time.
-- ✅ **THUMBNAILS ARE LIVE.** 77.5 MB → 0.78 MB on the biggest gallery; the Desk
-  ~100 MB → 1.12 MB. Four surfaces (tile, Desk strip, flag tray, filmstrip); the
-  review stage keeps the original.
+- ✅ **THUMBNAILS ARE LIVE, AND SIZED FOR THE TILE'S WIDTH** (operator,
+  2026-09-23: "blurry until selected"). The first cut capped the LONGEST side at
+  512, so a 704x1408 portrait got 256px of width for a 361px tile, stretched
+  1.4x at 1x and 2.8x on a 2x screen. Now they are 768 wide (2x the widest
+  desktop tile) and capped at 4096 tall, and an original that fits but weighs
+  over 64 KB is still re-encoded. Measured on the 381 live images: all
+  thumbnails 4.8 → 14.2 MB, still ~27x under the originals. ⚠ **768 is a LAYOUT
+  number:** `tests/test_thumbs_browser.py` holds it against the rendered grid,
+  so if a redesign widens the tiles, that test goes red. The 2-column (≤472px)
+  and 1-column (≤650px) reflows are softer than 768 covers at 2x; 1024 would
+  cover 2 columns for 18.5 MB total. Four surfaces (tile, Desk strip, flag tray,
+  filmstrip); the review stage keeps the original. The heid bug-hunt (4/4
+  arms) folded: a cache hit must be a regular file carrying its source's EXACT
+  mtime (a planted directory, or a `cp -p` older source, no longer pins a
+  thumbnail); the cache dirs are made without following links; the temp file is
+  mkstemp (the old `<out>.<pid>.tmp` could be planted as a link and was written
+  through); palette transparency survives; EXIF orientation is honoured; and
+  there's a 64 MP decode budget. The cache name carries the whole rule
+  (`.768x4096q78v2.webp`).
   → `persistent-memory.d/2026-09-23-the-cache-that-aged-the-thing-it-cached.md`
 - ✅ **CREATION + UPDATE DATES ARE ON THE RECORD** for all 30 booths
   (`created_at` via `statx`, `landed_at` already existed). design-dev renders