feat(tools): refimg — draw the design-alignment gate's reference images

[stellarfeline]

The design-alignment gate (skill step 4b) is confirmed against pictures. Owner
correction, 2026-08-07: the pictures it wants are reference images — concept
art drawn from the scene description before any prefab exists — not renders.
A render images a candidate prefab and belongs to contact-sheet curation later.
Building prefabs first and rendering them inverts the gate: it makes the owner
approve a build instead of a design.

tools/refimg.py is the first producer. Human-in-the-loop, advisory, never called
from a build.

Design decisions worth reviewing

The provider discriminant carries capability, not wire format. The obvious
move — reuse i18n's provider = "openai-compatible" — is a trap here. Google's
OpenAI-compatibility layer exposes /v1/images/generations but supports only
prompt, model, n, size, response_format, has no image input, and silently
ignores anything else. A style-anchored request routed through it would drop the
anchor without an error and return eight unrelated pictures. So only verified
providers are listed (ideogram-v3 today) and anything else is refused.

The full provider response is saved beside every image (<stem>.json). The
anchor a series depends on is recoverable only from what the provider actually
returns, and the API reference documents style_codes as an input without
promising one comes back. Record it and look — do not assume.

Failure modes are asymmetric, matching i18n.md: absent config prints what to
add and exits 2; malformed config is a hard error (inline api_key, unknown
provider, bad rendering_speed). A typo must never silently downgrade the anchor.
The key never enters a file — api_key_env names an env var read at call time,
never stored or logged, and it is not in the HTTP error path either.

What CI proves, and what it does not

Every refusal above was exercised by hand (transcripts in the commit trail):
happy-path --dry-run, inline-key refusal, unknown-provider refusal, and the
mutually-exclusive-anchor refusal. No live API call has been made — nothing
here is proven against the provider, and the first real call is what will settle
whether a style code is returned at all.

Blast radius

None. .refimg/ is gitignored; ref images are never shipped and never enter the
content repo, so output licensing never touches a shipped asset (ADR-0013), and
nothing is a build input (ADR-0006).

Docs + skill updated in the same PR (tooling-sync rule): a tools.md row, and an
advisory line at step 4b naming the reference/render distinction.

Left open, deliberately

Step 4b still describes both near and far view in render vocabulary ("orbit
render", "player-POV shots"). Rewriting that is a workflow change, not a tool
addition — flagged for the owner rather than folded in here.