feat(render): export templates + render-lesson entry; template owns include loop (WU-C', ADR-0011)

Replace the display(parts) entry (which a generated driver called) with the
template model: real editable templates (render/templates/{student,teacher}.typ,
the framework defaults copied into an engineering file's exports/) read the
manifest via toml(sys.inputs.manifest) and assemble parts themselves.

Key finding (drives the engine): a dynamic `include` inside a package resolves
against the PACKAGE root, never --root — so the include loop must live in the
TEMPLATE (which sits under --root): `include "/" + part.path + "/" + field +
".typ"` (root-relative absolute, runtime-computed — legal per ADR-0011's verified
fact). cph-render exposes render-lesson(info, target, parts, heading-numbering)
(content-in, never includes) + part-fields (kind→fields) + default-heading-numbering.
Numbering (numbly per-level) is set in the template, editable per engineering file.

Surfaced OPEN point closed by the engine (WU-D'): typst has no file-exists
primitive, so optional content (lemma proof) presence comes from a per-part
`fields` array the engine computes from disk. Manifest injected as root-relative
absolute (--input manifest=/...). numbly stays vendored/offline. display removed.

local-packages symlink (test-only @local resolution) gitignored — regenerable,
self-referential; the embedded engine mounts cph-render directly.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

render/lib.typ

@@ -1,21 +1,40 @@
 // cph-render — curriculum lesson render package.
 //
-// Single public entry: `display(info, target, parts)`.
+// PUBLIC ENTRY: `render-lesson(info, target, parts, heading-numbering)`.
 //
-// A lesson is an ORDERED array of typed parts. Each part is a dict with a
-// `kind` plus that kind's content/scalar fields. Content field VALUES are
-// already-evaluated typst content (the driver produces them via `include`) —
-// never modules or strings; we render them directly.
+// MODEL (ADR-0011). A build compiles a *template file* (e.g. `exports/student.typ`)
+// as the typst main, with the manifest injected via `--input manifest=<path>`.
+// The template reads the manifest, loads each part's content, and calls
+// `render-lesson` here. Presentation (heading numbering) lives in the template,
+// not the manifest, not hardcoded-unreachable in this package — we only provide
+// the DEFAULT scheme (`default-heading-numbering`) for the template to use or
+// override.
 //
-// kind -> fields (MVP):
+// WHY THE TEMPLATE LOADS CONTENT, NOT US (the include-resolution finding):
+//   typst resolves an `include`/`import` path relative to THE PACKAGE/FILE THE
+//   include LEXICALLY APPEARS IN, and a package (`@local/cph-render`) has its OWN
+//   virtual root. A dynamic `include` written inside this file resolves against
+//   the PACKAGE root — even an absolute `/segments/x.typ` lands in the package
+//   dir, NOT the engineering-file root (`--root`). Verified empirically.
+//   Therefore the dynamic-include LOOP must live in the TEMPLATE (which lives at
+//   `<root>/exports/*.typ`, so `/<part.path>/<field>.typ` resolves against
+//   `--root`). `render-lesson` is content-in: it takes an ALREADY-ASSEMBLED
+//   `parts` array of dicts and never includes anything itself.
+//
+// A part dict the template hands us:
+//   `kind` plus that kind's content/scalar fields. Content field VALUES are
+//   already-evaluated typst content (the template produced them via `include`).
+//
+// kind -> fields (MVP) — see `part-fields` below, which the template uses to
+// know what to load:
 //   segment : textbook (content, required)
 //   example : problem (content, required), solution (content, required),
-//             source (string, optional)
+//             source (string scalar, optional, from <path>/element.toml)
 //   lemma   : stmt (content, required), proof (content, optional)
 //   sop     : sop (content, required)
 //
 // target -> show/hide (the (kind x target) render matrix; defaults per
-// ADR-0005/0008, derived internally — caller passes no flags):
+// ADR-0005/0008, derived internally — template passes only the target string):
 //   student : example problem only (hide solution); lemma stmt only (hide
 //             proof); segment textbook; sop shown.
 //   teacher : everything shown.
@@ -30,6 +49,23 @@
 #import "src/elements/sop.typ": display-sop
 #import "src/elements/common.typ": example-counter, lemma-counter
 
+/// Per-kind field manifest, exported so a TEMPLATE knows exactly what to load
+/// for each part without hardcoding the matrix. For each kind:
+///   `content`: field names whose `<part.path>/<field>.typ` the template must
+///              `include` (assembling them into the part dict).
+///   `optional-content`: content fields that may be absent (template should
+///              probe before including; absence is fine).
+///   `scalars`: scalar field names the template reads from `<path>/element.toml`
+///              (currently only example `source`).
+/// Keeping this here (not in the template) keeps kind->fields a single source of
+/// truth in the package; the template iterates it generically.
+#let part-fields = (
+  segment: (content: ("textbook",), optional-content: (), scalars: ()),
+  example: (content: ("problem", "solution"), optional-content: (), scalars: ("source",)),
+  lemma: (content: ("stmt",), optional-content: ("proof",), scalars: ()),
+  sop: (content: ("sop",), optional-content: (), scalars: ()),
+)
+
 /// Resolve a target string to the set of show/hide booleans.
 /// Unknown targets fall back to the conservative (student-like) profile.
 #let _flags-for(target) = {
@@ -70,32 +106,28 @@
   }
 }
 
-/// THE ENTRY POINT.
+/// THE ENTRY POINT — called by a template (`exports/*.typ`).
 ///
 /// - `info`:   dict, e.g. (title: "…", author: "…"). `author` may be absent.
+///             Templates typically pass `manifest.at("info", default: (:))`.
 /// - `target`: string. MVP: "student" | "teacher". Unknown => conservative.
-/// - `parts`:  ordered array of part dicts (see file header).
-/// - `config`: dict carrying the target's build/presentation overrides
-///             (ADR-0009). Open/forward-compatible — read keys with
-///             `.at(.., default: ..)`. Recognised keys (MVP):
-///               `config.numbering.heading`: array of per-level numbly pattern
-///                 strings, e.g. `("{1:一}、", "{1:1}.{2:1}")`. Optional; when
-///                 absent the framework default (correct per-level scheme) is
-///                 used. Future presentation knobs slot in without touching
-///                 this signature.
-#let display(info: (:), target: "student", parts: (), config: (:)) = {
+///             Each template hardcodes its own target (student.typ => "student").
+/// - `parts`:  ordered array of part dicts, ALREADY ASSEMBLED by the template
+///             (content fields included, scalars read). See file header.
+/// - `heading-numbering`: array of per-level numbly pattern strings, e.g.
+///             `("{1:一}、", "{1:1}.{2:1}", "{1:1}.{2:1}.{3:1}")`. Presentation
+///             lives in the template (ADR-0011); the template passes its chosen
+///             scheme. Defaults to `default-heading-numbering` (the framework
+///             default) when the template omits it.
+#let render-lesson(
+  info: (:),
+  target: "student",
+  parts: (),
+  heading-numbering: default-heading-numbering,
+) = {
   let title = info.at("title", default: [])
   let author = info.at("author", default: none)
 
-  // Resolve presentation config -> framework defaults, file may override.
-  // `config.numbering.heading` (array of numbly patterns) overrides the
-  // framework default per-level numbering when present.
-  let numbering-cfg = config.at("numbering", default: (:))
-  let heading-numbering = numbering-cfg.at(
-    "heading",
-    default: default-heading-numbering,
-  )
-
   // `document` author wants a string/array; normalise the optional field.
   set document(
     title: title,