Diagram generation: ref-arch-driven procedure + spec validator + KB enrichment

The diagram path now follows a documented standard procedure (lookup
the closest Oracle Architecture Center reference → confirm components
→ author absolute_layout → spec validator → render → visually verify)
and ships persistent guardrails so layout regressions can't recur.

Persistent procedure changes (apply to all users, all sessions):
- tools/diagram_spec_validator.py — geometry checks (CONTAINER_TOO_THIN,
  CONTAINER_PADDING_VIOLATION, LABEL_OVERFLOW_PARENT) run BEFORE either
  renderer (drawio + PPTX). Catches the subnet-collapse / label-overflow
  bugs that the post-render drawio validator missed.
- tools/oci_diagram_gen.py + tools/oci_pptx_diagram_gen.py — call the
  spec validator before emitting any output. Adds mysql / mysql_heatwave
  type aliases.
- tools/archcenter_pattern_lookup.py — scores against cached page
  descriptions (not just the 1-line summary), supports --queries for
  multi-fragment composition, and applies synonym expansion via
  kb/architecture-center/synonyms.yaml so "LB HA cross AD" matches
  "load balancer high availability availability domain".
- kb/architecture-center/synonyms.yaml — canonical synonym table
  (load balancer, autonomous database, data guard, …) used by the
  lookup scorer.

KB enrichment:
- tools/archcenter_description_fetcher.py + 121 cached _description.md
  under kb/diagram/assets/archcenter-refs/<slug>/. Removes the runtime
  dependency on docs.oracle.com when authoring specs and feeds the
  pattern-lookup scorer.
- 110+ cached .drawio / .svg / .png references for offline reuse,
  plus the OCI Toolkit v24.2 import (kb/diagram/assets/oci-toolkit-drawio).

Documentation:
- docs/skill/output-formats.md — new "Standard diagram-generation
  procedure (MANDATORY)" + geometry rules + the new validator entry.
- SKILL.md option 2 — references the mandatory procedure.
- README.md — describes the spec validator, archcenter_pattern_lookup
  and description fetcher, and updates the KB-health table.

Tooling that backs the procedure (cumulative across recent sessions):
tools/archcenter_case_runner.py, archcenter_batch_driver.py,
archcenter_zip_downloader.py, drawio_visual_validator.py,
drawio_fidelity_eval.py, harvest_drawio_icon.py, import_oci_library.py,
oci_pptx_diagram_gen.py, oci_pptx_render.py, refresh_pptx_icon_index.py.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

kb/architecture-center/synonyms.yaml

@@ -0,0 +1,99 @@
+# Query-expansion synonyms for tools/archcenter_pattern_lookup.py
+#
+# Each canonical phrase is expanded with its aliases at query time so
+# free-text searches like "LB HA cross AD" match catalog entries
+# tagged "load balancer", "high availability", "availability domain".
+#
+# Add new entries when a query misses an obvious match. Keep aliases
+# lower-case alphanumeric — the tokenizer drops everything else.
+
+synonyms:
+  # Networking
+  - canonical: load balancer
+    aliases: [lb, lbaas, nlb, network load balancer, application load balancer, alb]
+  - canonical: virtual cloud network
+    aliases: [vcn]
+  - canonical: dynamic routing gateway
+    aliases: [drg]
+  - canonical: internet gateway
+    aliases: [igw]
+  - canonical: nat gateway
+    aliases: [natgw]
+  - canonical: service gateway
+    aliases: [sgw]
+  - canonical: site to site vpn
+    aliases: [vpn, ipsec, ipsec vpn]
+  - canonical: fastconnect
+    aliases: [fc, dx, direct connect, expressroute]
+  - canonical: remote peering connection
+    aliases: [rpc]
+  - canonical: web application firewall
+    aliases: [waf]
+  - canonical: network firewall
+    aliases: [nfw, ngfw]
+
+  # Compute / Containers
+  - canonical: virtual machine
+    aliases: [vm, ec2, gce, compute instance]
+  - canonical: container engine kubernetes
+    aliases: [oke, k8s, kubernetes, eks, gke, aks]
+  - canonical: bare metal
+    aliases: [bm, bms]
+
+  # Database
+  - canonical: autonomous database
+    aliases: [adb, adb-s, adb-d, atp, adw]
+  - canonical: exadata database service
+    aliases: [exacs, exadb, exa, exadata]
+  - canonical: base database service
+    aliases: [base db, dbcs, vm db]
+  - canonical: data guard
+    aliases: [dg, adg, active data guard]
+  - canonical: goldengate
+    aliases: [gg, ogg]
+  - canonical: mysql heatwave
+    aliases: [mysql, heatwave, mysql database service, mds]
+
+  # Availability / DR
+  - canonical: high availability
+    aliases: [ha, maa, maximum availability]
+  - canonical: disaster recovery
+    aliases: [dr, ha-dr, business continuity, bcdr]
+  - canonical: full stack disaster recovery
+    aliases: [fsdr]
+  - canonical: availability domain
+    aliases: [ad, az, availability zone]
+  - canonical: fault domain
+    aliases: [fd]
+  - canonical: cross region
+    aliases: [multi region, multiregion]
+
+  # Multicloud
+  - canonical: oracle database at azure
+    aliases: [odbaa, db at azure, dbaa, oracle@azure, azure-oracle]
+  - canonical: oracle database at aws
+    aliases: [odbaaws, db at aws, oracle@aws, aws-oracle]
+  - canonical: oracle database at google cloud
+    aliases: [odbagcp, db at gcp, oracle@gcp, gcp-oracle]
+
+  # Observability / Security
+  - canonical: monitoring
+    aliases: [mon, metrics]
+  - canonical: logging
+    aliases: [logs]
+  - canonical: cloud guard
+    aliases: [cg]
+  - canonical: data safe
+    aliases: [ds]
+  - canonical: security zone
+    aliases: [maximum security zone, msz]
+
+  # Workloads
+  - canonical: e business suite
+    aliases: [ebs, e-biz]
+  - canonical: peoplesoft
+    aliases: [psft]
+  - canonical: jd edwards
+    aliases: [jde, jd-e]
+  - canonical: artificial intelligence
+    aliases: [ai, gen ai, genai, ml]