fix: correctness, cross-backend parity & enforced quality gate (audit Sprints 2-4)

Audit-driven fixes across the dual backend, the premium workflow, and the
engineering layer. 318 tests, ruff-clean.

Quality gate (the moat):
- drawing_finalize now runs the premium ISO-128 critique in addition to the
  8-step validator; leftover construction, non-ISO lineweights, untrimmed
  corners, duplicates and dim overlap block the gate (strict_critique fails on
  warnings too).
- dim_overlap critique no longer a no-op (dim reference point + bbox fallback);
  dim/construction layers resolve from the active layer set (iso13567 too).

Stability / correctness:
- view_screenshot & drawing_export_pdf render headless via Agg (no more
  worker-thread SIGSEGV).
- gear tooth profile no longer self-overlaps at high tooth counts; section view
  no longer duplicates bore lines; validator keyway heuristic fixed.
- ezdxf aligned/angular dim API, full-circle polar array duplicate already
  covered by Sprint 1; this bundle adds save-format-from-extension,
  entity_offset side selection, ARC length, properties parity (bounding_box /
  rotation / char_height), mtext rotation.

COM robustness (mocked-COM tested):
- CoUninitialize on teardown; transaction commit/rollback try/finally + UNDO via
  the CMDACTIVE guard; system_run_lisp guard + USERS1 value capture;
  set_variable type coercion; HWND via Application.HWND; BlockInfo.description.

Security:
- HTTP remote-bind guard fires on every launch path (incl. `fastmcp run`);
  StaticTokenVerifier wired into FastMCP; AutoLISP allowlist bypass-vector tests.

Hygiene: linetype-on-demand in _apply_attrs, honest view_zoom returns, snap-on-arc
sweep handling, point_tangent acos clamp, dynamic tool_groups / tool count,
word-boundary SPUR/HELICAL, undo-stack locking.

Deferred: R22 (undo/transaction stack isolation) lands with the I1 refiner (1.2),
which depends on it.

engineering/layers.py

@@ -68,6 +68,23 @@ LAYER_SET_REGISTRY: dict[str, list[tuple[str, int, str, float, str]]] = {
     "iso13567": ISO13567_LAYERS,
 }
 
+# Role → layer name, per layer set. Lets dimension_auto / construction ops
+# resolve the correct layer for the active standard instead of hardcoding
+# "DIM"/"CONSTRUCTION" (which only exist in the mech/pid sets — iso13567 uses
+# M-DIMEN-T-N / M-CONST-E-N).
+LAYER_ROLES: dict[str, dict[str, str]] = {
+    "mech":     {"dim": "DIM",          "construction": "CONSTRUCTION"},
+    "pid":      {"dim": "DIM",          "construction": "CONSTRUCTION"},
+    "iso13567": {"dim": "M-DIMEN-T-N",  "construction": "M-CONST-E-N"},
+}
+
+
+def resolve_role_layer(layer_set_id: str | None, role: str) -> str:
+    """Resolve the layer name for `role` ('dim' | 'construction') in the active
+    layer set, falling back to the mech/default name when unknown."""
+    roles = LAYER_ROLES.get(layer_set_id or "mech", LAYER_ROLES["mech"])
+    return roles.get(role, LAYER_ROLES["mech"][role])
+
 STANDARD_LINETYPES: list[str] = ["CENTER", "HIDDEN", "PHANTOM", "DASHED", "DASHDOT"]