fix(page): separate measurement context from the render canvas (S3)

add_child invalidated the canvas but left _draw bound to it, and the draw
property only rebuilt when _draw was None. Callers therefore got a context
pointing at a discarded image while page._canvas stayed None. table_layouter
reads page._canvas directly, so every image inside a table cell laid out after
any other content silently degraded to a grey [Image: WxH] placeholder.

The property now rebuilds when either half is missing. On its own that would
make layout allocate a full-page RGBA canvas per line, because layout measures
text through the page - so measurement moves to page.measurement_draw, a 1x1
scratch context that is never invalidated. Its mode matches the render canvas
so that Text's width cache does not hold two entries per word.

Children built against the scratch context are re-bound to the live canvas by
render_children, which already synchronised _draw and _canvas; that behaviour
was incidental and is now load-bearing and documented as such.

Regenerating the examples shows table images rendering as images rather than
placeholders. The empty header row in the second table of example 05 is
unrelated and pre-existing - row height ignores cell padding, so text is clipped
as padding grows - recorded as evidence under S6.

docs/LAYOUT_REMEDIATION_SPEC.md

@@ -560,6 +560,22 @@ Four separate geometry defects:
    drops every cell past `len(column_widths)` — two of three cells never render.
 4. **rowspan is parsed and stored but never read** by any renderer or measurer;
    spanned rows just shift left.
+5. **Row height ignores the cell padding it must contain.** The 40px minimum in
+   `_calculate_row_height_for_section` is a constant, so a larger `cell_padding`
+   eats into the content box rather than growing the row, and
+   `_render_cell_content` then clips the text against `available_height`.
+   Rendering the same header at two paddings:
+
+   ```
+   padding=(8,10,8,10)   border=1: header h=40, ink=593
+   padding=(10,12,10,12) border=2: header h=40, ink=288
+   ```
+
+   Both rows are 40px tall; the second silently loses half its text. This is
+   visible in `docs/images/example_05_html_table_with_images.png`, whose second
+   table renders an empty header row. It is the same measure/render disagreement
+   as defect 1, and S5 removes it by construction: the cell page's content box
+   *is* the box its padding leaves.
 
 ### Design