fix(thumbs): fold the heid bug-hunt: a cache that cannot be planted, alpha, orientation

The heid bug-hunt panel on c2b1454 (4/4 arms, five seat-executed probes). The
new size rules governed only cache MISSES; the hit path trusted a name and an
mtime, inside a directory any fleet session can write into.

- A cache hit is a REGULAR file (lstat) carrying its source's EXACT mtime (4/4).
  A planted directory at the cache path was returned as the thumbnail, and a
  source replaced by `cp -p` or an archive extract kept an older stamp that
  `>=` served forever. The encoder now stamps the thumbnail with the source's
  mtime, so any change to the source is a miss.
- The cache directories are made component by component and never through a
  link (seat P4). A `.thumbs` planted as a link put the cache outside the
  booth, beyond the sweep. The booth-mtime restore now keys on creating
  `.thumbs` itself.
- The temp file is mkstemp (4/4, seat P5). The old `<out>.<pid>.tmp` was
  predictable, and a link planted there made the encoder overwrite its target
  (600 B became 316,400 B).
- Palette transparency survives (3/4, seat-executed, and INTRODUCED by
  c2b1454). The fits-but-heavy branch newly re-encoded palette PNGs, and
  getbands() of mode P has no A even with tRNS.
- EXIF orientation is honoured for sizing and for the saved image (groa,
  seat-verified). A camera portrait stored sideways was sized and tiled as a
  landscape.
- A 64 MP decode budget (2/4). A header claims any size, and a failure is not
  cached, so every request re-decoded it.
- The cache name carries the whole rule: width, height cap, quality and an
  encoding version (groa). The width alone would have served stale bytes after
  a quality change.

Declined: the utime-restore failing on a foreign-owned booth (booths are the
service user's), and regin's two solos (the THUMB_MAX export is not imported
anywhere; the live fixture is function-scoped). thumbs.toml: 14/14 proved.

persistent-memory.md

@@ -54,7 +54,14 @@ _As of 2026-09-23:_
   so if a redesign widens the tiles, that test goes red. The 2-column (≤472px)
   and 1-column (≤650px) reflows are softer than 768 covers at 2x; 1024 would
   cover 2 columns for 18.5 MB total. Four surfaces (tile, Desk strip, flag tray,
-  filmstrip); the review stage keeps the original.
+  filmstrip); the review stage keeps the original. The heid bug-hunt (4/4
+  arms) folded: a cache hit must be a regular file carrying its source's EXACT
+  mtime (a planted directory, or a `cp -p` older source, no longer pins a
+  thumbnail); the cache dirs are made without following links; the temp file is
+  mkstemp (the old `<out>.<pid>.tmp` could be planted as a link and was written
+  through); palette transparency survives; EXIF orientation is honoured; and
+  there's a 64 MP decode budget. The cache name carries the whole rule
+  (`.768x4096q78v2.webp`).
   → `persistent-memory.d/2026-09-23-the-cache-that-aged-the-thing-it-cached.md`
 - ✅ **CREATION + UPDATE DATES ARE ON THE RECORD** for all 30 booths
   (`created_at` via `statx`, `landed_at` already existed). design-dev renders