Align fill-only box damage with the composed painter world

[softmarshmallow]

Problem

Fill-only Rect and Ellipse nodes derive damage coverage from the producer's
node.bounds, which is computed by applying the original affine to absolute
local coordinates. The private painter takes a rounding-distinct route: it
first composes the box origin into world in f32, then maps a 0..width /
0..height primitive through that composed matrix.

Those routes are algebraically equal but not bit-equivalent. Under
cancellation, the private fill can reach a finite pixel coordinate outside the
recorded damage envelope, so an incremental repaint can omit changed fill ink.

The stroke-width percentage-saturation rung closes this for stroked boxes by
unioning the direct projection with the actual composed-box projection. It
deliberately does not broaden that capability patch into fill-only damage.

Reproduction shape

The stroke-side arithmetic audit found a final-encoding witness with:

• affine a = 0x947982c2, tx = 0x214afd2a, other x-row cross term zero;
• rect x = 0xee47e90e, width = 0x6e1245fa, y = 0, height = 1;
• frame 0,0,64,64.

For the analogous composed box route, compare the absolute-coordinate
math2::rect_transform envelope against
node.transform.then(translate(rect.x, rect.y)) applied to the origin and far
edge, through final outward RectF encoding. Pin a fill-only witness whose
private endpoint lies outside the current coverage. The originating exhaustive
search compared those two operation orders at each finite f32 bit pattern and
then tested containment only after the same frame clip and outward RectF
encoding used by the product.

Required outcome

1. Fill coverage for Rect and Ellipse follows or conservatively encloses the
   same composed f32 world that the private painter executes.
2. Path coverage keeps its absolute-coordinate route.
3. Projection remains outward-conservative, finite, and frame-bounded; paint
   reference boxes remain geometry bounds.
4. Add exact Rect and Ellipse regressions through final damage encoding and a
   before/after diff_frame law.

Scope

This is a pre-existing fill damage/provenance defect, not a Web stroke-width or
paint-semantic gap. It is related to, but distinct from, the generic union
representation failures tracked in #87.