Add native Go port of Rough.js 4.0.4

[alixander]

Summary

• port Rough.js 4.0.4's generator and renderer pipeline to native Go
• preserve ordered operations, SVG path serialization, SVG path parsing, seeded random streams, every fill style, and the full generator method/options surface
• retain exact upstream MIT attribution and document the pinned source and D2 oracle artifacts
• add pure-Go unit, race, and pinned differential CI with no production JavaScript dependency

Compatibility

This targets the exact Rough.js 4.0.4 behavior embedded by D2:

• upstream commit: 35302b8f1119ad004b4550f9a4d4162d3d845b0a
• D2 bundle SHA-256: 5601a7c6046815613316d882ffbaede24261bfec295e3502ae7539abb1814820
• pristine npm bundle SHA-256: 21f8682b994c6063e9605a19f50a6bd9f3b0901cbff4db2326b3f85308e29b7f

Rough.js 4.0.4 did not ship an automated test suite, so parity is enforced with source-shaped tests, D2's exact sketch goldens, and a deterministic 1,000-call differential across all 9 generator methods, all 7 fill styles, and all 18 public options.

D2's former Goja runtime matches rough-go strictly on arm64 and amd64. Node/V8 has four deterministic engine/libm boundary cases where tiny intermediate differences are amplified by Rough.js's random-offset calculations; those exact calls use narrowly scoped 0.1-1px numeric tolerances while topology, operation order, styles, options, and all other 996 calls remain strict.

Dependent D2 migration: d2lang/d2#2821. D2 pins this pushed commit by pseudo-version; no local replacement is used.

Tests

• go test ./...
• go test -race ./...
• go vet ./...
• Go 1.23.12 compatibility
• 1,000-call differential against both pinned Rough.js bundles on arm64 and amd64/x64