🔒️ Validate downloaded font content before writing to cache

[sjquant]

Summary

• Validate downloaded font bytes against known magic signatures (TTF, OTF, TTC, WOFF, WOFF2) before writing to cache
• Raise RenderingError with a clear message when content is not a valid font — no partial cache file is written
• Also updates TASKS.md: marks gradient/grain features done, removes the GrainLayer tasks that were dropped

Test plan

• test_should_raise_error_when_font_data_is_not_a_valid_font — non-font bytes raise RenderingError
• test_should_not_write_cache_file_when_font_data_is_invalid — cache dir stays empty on bad input
• test_should_accept_valid_font_magic_bytes (parametrized × 6) — all valid signatures accepted
• Existing webfont download tests still pass with updated fake font data

https://claude.ai/code/session_01UCAexPKGo4yjaf3cMNVwGG