fix: correctness, cross-backend parity & enforced quality gate (audit Sprints 2-4)

Audit-driven fixes across the dual backend, the premium workflow, and the
engineering layer. 318 tests, ruff-clean.

Quality gate (the moat):
- drawing_finalize now runs the premium ISO-128 critique in addition to the
  8-step validator; leftover construction, non-ISO lineweights, untrimmed
  corners, duplicates and dim overlap block the gate (strict_critique fails on
  warnings too).
- dim_overlap critique no longer a no-op (dim reference point + bbox fallback);
  dim/construction layers resolve from the active layer set (iso13567 too).

Stability / correctness:
- view_screenshot & drawing_export_pdf render headless via Agg (no more
  worker-thread SIGSEGV).
- gear tooth profile no longer self-overlaps at high tooth counts; section view
  no longer duplicates bore lines; validator keyway heuristic fixed.
- ezdxf aligned/angular dim API, full-circle polar array duplicate already
  covered by Sprint 1; this bundle adds save-format-from-extension,
  entity_offset side selection, ARC length, properties parity (bounding_box /
  rotation / char_height), mtext rotation.

COM robustness (mocked-COM tested):
- CoUninitialize on teardown; transaction commit/rollback try/finally + UNDO via
  the CMDACTIVE guard; system_run_lisp guard + USERS1 value capture;
  set_variable type coercion; HWND via Application.HWND; BlockInfo.description.

Security:
- HTTP remote-bind guard fires on every launch path (incl. `fastmcp run`);
  StaticTokenVerifier wired into FastMCP; AutoLISP allowlist bypass-vector tests.

Hygiene: linetype-on-demand in _apply_attrs, honest view_zoom returns, snap-on-arc
sweep handling, point_tangent acos clamp, dynamic tool_groups / tool count,
word-boundary SPUR/HELICAL, undo-stack locking.

Deferred: R22 (undo/transaction stack isolation) lands with the I1 refiner (1.2),
which depends on it.

tests/test_security.py

@@ -229,3 +229,46 @@ class TestSanitizeLisp:
 
         monkeypatch.delenv("DANGEROUS_COMMANDS_ENABLED", raising=False)
         config.settings = Settings()
+
+
+class TestSanitizerBypassVectors:
+    """R8 — adversarial coverage: the deny-list must hold against common evasion
+    tricks. Each asserts the guard REJECTS the payload (defensive verification),
+    plus that legitimate input is NOT over-blocked."""
+
+    def test_command_newline_injected_second_command(self):
+        # A safe head command with a dangerous one smuggled after a newline.
+        with pytest.raises(ToolError, match="restricted command"):
+            sanitize_command("_ZOOM E\n_ERASE")
+
+    def test_command_case_insensitive(self):
+        with pytest.raises(ToolError, match="restricted command"):
+            sanitize_command("eRaSe all")
+
+    def test_command_legitimate_not_overblocked(self):
+        assert sanitize_command("_LINE 0,0 10,10") == "_LINE 0,0 10,10"
+
+    def test_lisp_symbol_aliasing_blocked(self):
+        # (setq f command) references `command` as a value to dodge head-only
+        # matching — the bare-token scan must still catch it.
+        with pytest.raises(ToolError, match="restricted function"):
+            sanitize_lisp("(setq f command)(f)")
+
+    def test_lisp_activex_family_blocked(self):
+        with pytest.raises(ToolError, match="restricted function"):
+            sanitize_lisp('(vlax-invoke obj "SendCommand" "x")')
+
+    def test_lisp_express_tools_shell_blocked(self):
+        with pytest.raises(ToolError, match="restricted function"):
+            sanitize_lisp('(acet-sys-shell "cmd")')
+
+    def test_lisp_custom_command_invocation_blocked(self):
+        with pytest.raises(ToolError, match="restricted function"):
+            sanitize_lisp("(c:mycmd)")
+
+    def test_lisp_dangerous_token_inside_wrapper_blocked(self):
+        with pytest.raises(ToolError, match="restricted function"):
+            sanitize_lisp('(startapp (strcat "c" "md"))')
+
+    def test_lisp_legitimate_not_overblocked(self):
+        assert sanitize_lisp("(setq x (* 2 3))") == "(setq x (* 2 3))"