fix: seven defects an adversarial audit found, and the gates that missed them

Every one of these was reported ok/clean to the caller while being wrong.

Silently wrong numbers
- selection_filter(min_area) read `entity.dxf.get("area", 0.0)` for SOLID,
  TRACE and HATCH, none of which carry that attribute, so every hatch
  measured 0.0. A 1600 mm^2 hatch was excluded by min_area=1.0 while
  `filtered_by` asserted the filter had run, and COM (which reads ActiveX
  .Area) returned a different selection for the same call. It now answers
  from the measurement `entity_measure` uses, so the two cannot disagree.
- Every headless dimension rendered through ezdxf's bare `Standard` style:
  1.0 mm text with a comma decimal marker, against ISO 3098's 2.5 mm minimum
  and ISO 129's point -- while the document header itself said $DIMTXT 2.5.
  `ezdxf.new(setup=True)` is not the fix; measured, it renders a 100 mm
  dimension as "10000". The attributes are now stored explicitly.
- Saving writes `dimrnd = 0.0` onto the Standard style, and ezdxf applies
  `xround(value, dimrnd)` whenever the attribute is present at all --
  `xround(33.333, 0.0)` is 33. So on any reopened file, including one this
  server saved, every dimension was rounded to a whole unit before DIMDEC
  formatted it: a 12.75 mm feature dimensioned 13. AutoCAD means DIMRND 0 as
  *no* rounding; the sentinel is now discarded at every load site, and a real
  0.5 mm rounding is left alone.
- The DIM* header fold gave out-of-range values teeth they did not have when
  they died in the header: dim_decimals=-1 returned ok and then killed the
  next dimension with `ValueError: Format specifier missing precision` from
  inside ezdxf, and 40 printed forty digits of float noise onto the sheet.
  Ranges are now AutoCAD's own (DIMDEC 0-8, DIMZIN 0-15, lengths positive).

Security
- security.py recorded the policy as "sanitize_command and sanitize_lisp each
  have exactly ONE caller ... the policy is scoped to the CHANNEL". The
  premise was false. `_ensure_linetype_loaded` and `ComBackend.linetype_load`
  build `_-LINETYPE _LOAD {name} {file}` and hand it to SendCommand, which
  treats a newline and ';' as segment separators -- so a `linetype=` argument
  carrying either injected further AutoCAD commands, and the 36-verb denylist
  never saw that channel. Guarded with the DXF symbol-name rule (the
  injection characters fall out of it rather than being enumerated) plus
  validate_path for the file argument, which was also the one path-taking
  tool reaching the filesystem unchecked. The policy comment is corrected.

Gates that could not see
- drawing_critique returned zero issues on a quarantined document: all seven
  checks wrapped their backend call in a bare `except Exception`. CLAUDE.md
  rule 7 makes that call the gate an agent is told to trust. Only the
  quarantine now escapes; an ordinary broken check still degrades.
  `_check_dimension_legibility` also read `_doc` directly from the event loop
  thread, missing the gate and performing exactly the unsynchronised access
  the quarantine exists to prevent. `construction_clear` answered
  "deleted: 0" -- there was nothing to clear -- for the same reason.
- The iso128 focus checked layer lineweights only, so a sheet lettered at
  1.0 mm critiqued clean. It now reads the effective dimension height and
  separator, header-then-style, in the order the renderer resolves.
- check_doc_numbers.py derived five values it never checked, and those were
  the ones that had drifted. The collected-test count (README said 1274, the
  tree had 1369) and the A/B pass-rate and Fixed columns are now gated.
- benchmarks/README.md's v1.4.0 table was impossible on its face -- 21
  passing plus 5 fixed is 26, not 24 -- and contradicted the report it
  linked, because `ab-v1.4.0-vs-v1.5.0.json` was regenerated from a tree that
  already carried the dimension fixes and so never measured the v1.5.0 tag.
  Replaced with a real run: ab-v1.4.0-vs-v1.5.1.json, 21/26 -> 26/26.

Release gate
- release.yml ran one ubuntu/3.11 lane, so a Windows-only defect could reach
  PyPI with no Windows job having executed. That is not hypothetical: v1.5.0
  shipped `except pywintypes.com_error` raising NameError wherever pywin32 is
  absent. It now runs the same three lanes as ci.yml, Windows included.

1368 passed, 1 xfailed. ruff clean. Tool inventory and all 16 gated document
numbers match the tree.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

security.py

@@ -151,7 +151,15 @@ def validate_path(path: str, *, allow_write: bool = False) -> Path:
 # `sanitize_command` and `sanitize_lisp` each have exactly ONE caller, both of
 # them the COM-only free-text escape hatch into SendCommand. The policy is
 # scoped to the CHANNEL, not to the operation, which is capability narrowing
-# rather than a contradiction:
+# rather than a contradiction.
+#
+# That "the CHANNEL" was singular was wrong, and it took an audit to notice.
+# `_ensure_linetype_loaded` and `ComBackend.linetype_load` reach SendCommand
+# too, carrying a caller's linetype name and file path, and neither passed
+# through anything here — so the denylist below was guarding one door of two.
+# `sanitize_symbol_name` / `sanitize_macro_argument` at the end of this module
+# close the other. Before adding a third SendCommand site, guard it there and
+# amend this paragraph rather than this one:
 #
 #   * `block_insert(name, x, y, ...)` takes a block ALREADY in the drawing plus
 #     typed geometry. The INSERT *command* takes a file path and pulls in an
@@ -349,3 +357,76 @@ def sanitize_lisp(expression: str) -> str:
         )
 
     return expression
+
+
+# ---------------------------------------------------------------------------
+# Symbol-table names interpolated into a SendCommand macro
+# ---------------------------------------------------------------------------
+#
+# The scoped-to-the-CHANNEL argument above assumed `sanitize_command` and
+# `sanitize_lisp` were the only routes into SendCommand. They were not.
+# `_ensure_linetype_loaded` builds `_-LINETYPE _LOAD {name} {file}` from a
+# caller's `linetype=` argument, and `ComBackend.linetype_load` adds a
+# caller-supplied path. SendCommand takes a whole macro and treats a newline
+# and `;` as segment separators, so either string could append commands that
+# the 36-verb denylist never sees.
+#
+# The guard is the DXF symbol-name rule rather than a second blocklist. AutoCAD
+# already forbids these characters in a table name, so nothing this rejects was
+# ever a loadable linetype, and the injection characters fall out of the rule
+# instead of having to be enumerated and kept up to date.
+
+#: Characters DXF forbids in a symbol-table name, plus the whitespace that ends
+#: a SendCommand segment.
+_FORBIDDEN_SYMBOL_CHARS = set('<>/\\":;?*|,=`') | set("\n\r\t")
+
+#: Long enough for any real linetype, short enough not to be a payload.
+_MAX_SYMBOL_NAME = 255
+
+
+def sanitize_symbol_name(name: str, *, kind: str = "symbol") -> str:
+    """Return `name` if it is a legal DXF symbol-table name, else refuse.
+
+    Used at every point where a caller-controlled name is interpolated into an
+    AutoCAD command macro. The refusal deliberately does not echo the rejected
+    string back: an error message that a client logs or renders is a channel
+    too, and a payload that reaches a log is a payload that reached something.
+    """
+    candidate = (name or "").strip()
+    if not candidate:
+        raise ToolError(f"{kind} name rejected: empty.")
+    if len(candidate) > _MAX_SYMBOL_NAME:
+        raise ToolError(f"{kind} name rejected: longer than {_MAX_SYMBOL_NAME} characters.")
+    offenders = sorted({c for c in candidate if c in _FORBIDDEN_SYMBOL_CHARS or ord(c) < 32})
+    if offenders:
+        shown = ", ".join(repr(c) for c in offenders)
+        raise ToolError(
+            f"{kind} name rejected: DXF symbol-table names cannot contain {shown}. "
+            "This name would also end the AutoCAD command macro it is placed in."
+        )
+    return candidate
+
+
+#: What ends a segment inside a SendCommand macro. A path legitimately contains
+#: ':' and '\', so a file argument cannot be held to the symbol-name rule -- it
+#: gets this narrower one plus `validate_path`.
+_MACRO_SEPARATORS = set("\n\r;") | {chr(c) for c in range(32)}
+
+
+def sanitize_macro_argument(value: str, *, kind: str = "argument") -> str:
+    """Return `value` if it cannot end the AutoCAD command macro it sits in.
+
+    For arguments that are legitimately allowed the characters DXF forbids in a
+    symbol name -- a file path, mostly. Narrower than `sanitize_symbol_name` on
+    purpose: the goal is only that the string cannot start a second command.
+    """
+    candidate = (value or "").strip()
+    if not candidate:
+        raise ToolError(f"{kind} rejected: empty.")
+    if any(c in _MACRO_SEPARATORS for c in candidate):
+        raise ToolError(
+            f"{kind} rejected: contains a newline, carriage return, semicolon or "
+            "control character, which would end the AutoCAD command macro it is "
+            "placed in and start another."
+        )
+    return candidate