Diagram generation: ref-arch-driven procedure + spec validator + KB enrichment

The diagram path now follows a documented standard procedure (lookup
the closest Oracle Architecture Center reference → confirm components
→ author absolute_layout → spec validator → render → visually verify)
and ships persistent guardrails so layout regressions can't recur.

Persistent procedure changes (apply to all users, all sessions):
- tools/diagram_spec_validator.py — geometry checks (CONTAINER_TOO_THIN,
  CONTAINER_PADDING_VIOLATION, LABEL_OVERFLOW_PARENT) run BEFORE either
  renderer (drawio + PPTX). Catches the subnet-collapse / label-overflow
  bugs that the post-render drawio validator missed.
- tools/oci_diagram_gen.py + tools/oci_pptx_diagram_gen.py — call the
  spec validator before emitting any output. Adds mysql / mysql_heatwave
  type aliases.
- tools/archcenter_pattern_lookup.py — scores against cached page
  descriptions (not just the 1-line summary), supports --queries for
  multi-fragment composition, and applies synonym expansion via
  kb/architecture-center/synonyms.yaml so "LB HA cross AD" matches
  "load balancer high availability availability domain".
- kb/architecture-center/synonyms.yaml — canonical synonym table
  (load balancer, autonomous database, data guard, …) used by the
  lookup scorer.

KB enrichment:
- tools/archcenter_description_fetcher.py + 121 cached _description.md
  under kb/diagram/assets/archcenter-refs/<slug>/. Removes the runtime
  dependency on docs.oracle.com when authoring specs and feeds the
  pattern-lookup scorer.
- 110+ cached .drawio / .svg / .png references for offline reuse,
  plus the OCI Toolkit v24.2 import (kb/diagram/assets/oci-toolkit-drawio).

Documentation:
- docs/skill/output-formats.md — new "Standard diagram-generation
  procedure (MANDATORY)" + geometry rules + the new validator entry.
- SKILL.md option 2 — references the mandatory procedure.
- README.md — describes the spec validator, archcenter_pattern_lookup
  and description fetcher, and updates the KB-health table.

Tooling that backs the procedure (cumulative across recent sessions):
tools/archcenter_case_runner.py, archcenter_batch_driver.py,
archcenter_zip_downloader.py, drawio_visual_validator.py,
drawio_fidelity_eval.py, harvest_drawio_icon.py, import_oci_library.py,
oci_pptx_diagram_gen.py, oci_pptx_render.py, refresh_pptx_icon_index.py.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tools/refresh_oci_drawio_toolkit.py

@@ -0,0 +1,66 @@
+#!/usr/bin/env python3
+"""
+refresh_oci_drawio_toolkit — fetch the official Oracle Style Guide for
+Draw.io and place its assets under ``kb/diagram/assets/oci-toolkit-drawio/``.
+
+Source (canonical, 2026-04):
+  https://docs.oracle.com/iaas/Content/Resources/Assets/OCI-Style-Guide-for-Drawio.zip
+
+The toolkit ships:
+  - OCI Architecture Diagram Toolkit v24.2.drawio  (~4.5 MB)
+  - OCI Library.xml                                (~1.4 MB — drawio
+    shape library, drop into Extras → Edit Library)
+  - Read-ME.drawio                                 (style guide)
+
+These are the sources of truth for:
+  - Container styles (region/AD/VCN/subnet) — already extracted into
+    kb/diagram/oci-toolkit-styles.yaml
+  - Service icon stencils — extracted into kb/diagram/oci-icons.json
+  - Connector styles — also in kb/diagram/oci-toolkit-styles.yaml
+
+Run this script when:
+  - Oracle ships a new version (look for v24.x or v25.x in the zip).
+  - You need to rebuild oci-icons.json after editing extraction logic.
+"""
+
+from __future__ import annotations
+
+import argparse
+import io
+import sys
+import urllib.request
+import zipfile
+from pathlib import Path
+
+DEFAULT_URL = "https://docs.oracle.com/iaas/Content/Resources/Assets/OCI-Style-Guide-for-Drawio.zip"
+DEFAULT_DEST = Path(__file__).resolve().parent.parent / "kb" / "diagram" / "assets" / "oci-toolkit-drawio"
+
+
+def fetch_zip(url: str) -> bytes:
+    print(f"Fetching {url}", file=sys.stderr)
+    with urllib.request.urlopen(url, timeout=60) as resp:
+        return resp.read()
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--url", default=DEFAULT_URL)
+    parser.add_argument("--dest", type=Path, default=DEFAULT_DEST)
+    parser.add_argument("--source", type=Path, default=None,
+                        help="Local path to a pre-downloaded zip (skips network).")
+    args = parser.parse_args()
+
+    blob = args.source.read_bytes() if args.source else fetch_zip(args.url)
+    args.dest.mkdir(parents=True, exist_ok=True)
+    with zipfile.ZipFile(io.BytesIO(blob)) as z:
+        for member in z.namelist():
+            if member.endswith("/"):
+                continue
+            target = args.dest / Path(member).name
+            target.write_bytes(z.read(member))
+            print(f"  wrote {target.relative_to(args.dest.parent.parent.parent)}", file=sys.stderr)
+    print(f"\nToolkit refreshed under {args.dest}", file=sys.stderr)
+
+
+if __name__ == "__main__":
+    main()