Budget an embedded-font form fill as one operation #518

Context

DESIGN.md section 3 (F6) bounds every operation by one budget. #194 (PR #489) made a form fill with Form.font set run as one transaction, but the fill makes several independently budgeted core calls: form_field_fill(draw=False), form_field_draw_face (twice), embedded_font, and add_glyphs. Text shaping is also unbounded until #493.

Goal

A form fill with an embedded Form.font charges one operation budget across all its core calls. When that budget is exceeded, the whole fill rolls back.

Scope

In: sharing one budget across the fill's core calls, and a memory-limit test that checks the rollback of a whole fill.
Out: canvas preparation (#500), and shaping budgets (#493).

Paths

• crates/pyropdf-python/src/forms.rs
• crates/pyropdf-engine/src/forms/
• python/pyropdf/_form.py
• tests/test_acroform.py

Acceptance

• One budget covers every core call of an embedded-font fill.
• A test sets a memory limit that the fill exceeds. It checks that the value, the appearances, and the font's glyphs all roll back, and that the undo history is unchanged.

Notes

Follows the pattern that #500 sets for the canvas. Raised in the review update on #489.