Preflight Negative Test

Deterministically triggers a REAL bounds-check failure through the actual production renderer (a 60-character unbroken title, which Session 2A-i.1's regression suite confirmed reliably exceeds the page width since titles are character-sliced, not width-checked) -- not a mocked response, not a manifest-mutation shortcut. Confirms the full pipeline (render -> preflight -> fail closed) behaves exactly like the public path would on equivalently bad input, and that _deliver_pdf (and therefore the R2 upload it performs) is never reached: the early return on a failed preflight is structural, not conditional, so no upload is attempted here by construction.