Check collection growth outside the store, starting with pyropdf-schema #675

Context

DESIGN.md F6 and section 9: a collection that grows from input grows through the operation's budget (BudgetVec). #43 made clippy refuse the growing methods of the standard collections in the store (crates/pyropdf-store/clippy.toml). Clippy reads the configuration nearest to the crate that it checks, and #43 left the other crates out, so nothing checks F6 in pyropdf-schema, pyropdf-engine, or pyropdf-python.

Applied to them at 0.2.2 (11bbbba), the store's configuration reports:

CLIPPY_CONF_DIR="$PWD/crates/pyropdf-store" cargo clippy -p pyropdf-schema -p pyropdf-engine -p pyropdf-python --lib --all-features --message-format=short

Many uses are bounded by something other than input (12 of 14 sampled Dict::insert calls write a constant key), but without the check no one can tell which. This issue sets up a configuration that every crate can share and checks the smallest crate with it. The engine and the binding follow in their own issues, which this one blocks.

Goal

pyropdf-schema is checked as the store is, by a configuration that the engine and the binding adopt without copying it.

Scope

In:

• where the configuration lives: for example one clippy.toml at the workspace root, which clippy finds by looking upward from a crate's manifest, with the store's extra entries in its own file; or another arrangement that keeps one list;
• whether the crates outside the store disallow Dict::insert and Array::push. In the store they check the store's own value growth; elsewhere most calls write constant keys;
• the 24 uses in pyropdf-schema: grown through the budget, or #[expect(clippy::disallowed_methods, reason = "...")] with what bounds them;
• AGENTS.md's F6 sentence, which names the store's file.

Out: the engine and the binding (their own issues); fuzz/ and the evidence crates, which tools/check.py does not lint.

Paths

clippy.toml (new, at the root) or crates/pyropdf-schema/clippy.toml, crates/pyropdf-store/clippy.toml, crates/pyropdf-store/src/lib.rs, crates/pyropdf-schema/src/, and AGENTS.md (the F6 sentence).

Acceptance

• The configuration binds pyropdf-schema, and CI's cargo clippy --workspace --all-targets --all-features -- -D warnings passes with each remaining use either budgeted or expecting the lint with its bound.
• The store refuses the same uses as before.
• The configuration's comment records whether Dict::insert and Array::push are disallowed outside the store, and why.
• The engine and binding issues name the configuration that they adopt.
• AGENTS.md's F6 sentence points at the shared configuration.

Notes

• The store's lib.rs allows the lint under cfg(test); each crate that adopts the check needs the same.
• A root clippy.toml is also found by fuzz/ and the evidence crates when someone runs clippy there. Keep them unaffected, or say why it does not matter.
• Check that the store grows input-derived collections through the budget #43's pull request is the model for the expect reasons.