Generative: a mask shown to read takes no pen; strokes fail loud

InpaintCanvas is a Tab stop with the focus ring only when on_brush
serves its keys, and takes the pen, the crosshair and the ring only
with on_stroke. new() asserts each stroke's radius within REACH and
its points on the picture. The settled strokes' cells stay cached, so
a drag paints only the stroke under the pen over a copy. The canvas
keeps square corners, so the wash fits the picture. The gallery drags
with moves.

TASKS.md

@@ -295,3 +295,4 @@ Per-component lines live in `tasks/`. Tags there:
 | T25a | 2 | PASS | |
 | T25b | 1 | FAIL | a done result with nothing to open still took focus on a press and drew a ring the keys could not reach |
 | T25b | 2 | PASS | |
+| T25c | 1 | FAIL | a canvas with no handlers still took Tab, the pen and the ring; strokes from the host went unchecked |