[clowders]

Wrap the default Linux Chromium browser with a Fontconfig configuration generated from pinned Nixpkgs Liberation and DejaVu fonts. Add a sandbox integration test that checks rasterized text and a fixed layout; it fails with plain Chromium and passes with the font wrapper.

Checks: nix build --no-link .#checks.x86_64-linux.r-shinytest2, nix build --no-link .#checks.aarch64-linux.r-shinytest2, nix develop --command tasks all, and nix develop --command nix flake check --print-build-logs.

Closes #256

[clowders]

Investigated both failing consumer-contract checks:

Run	Classification	Decision
40421505655 (pull_request)	Pre-existing	Follow up in #261; no change in this PR.
40421485864 (push)	Pre-existing	Same root cause and follow-up.

Both stop during nix develop --command check-fixtures, before fixture execution,
when GitHub returns HTTP 404 for the pinned private dataheld/maxheld archive
at 83c05ac1282b2add9516117102c2a561d709b27e.
The identical error already occurs in main's run
40411158830
at this PR's base 76ddf79, after #254 changed the dev brand input.
This PR does not change that input, lock, dev configuration, or workflow.

No code changed, no commit/push required, and no CI re-run requested:
a re-run alone will not resolve private dependency access.
Full local validation was not repeated because there is no code change;
the matching main and PR logs establish this failure independently of the
Chromium change.
The checks remain blocked pending #261 and subsequent CI re-runs.