feat(checker): align cph-typst + cph-check to export-as-build model (WU-D)

Integrate the WU-B (structured targets) and WU-C (numbly, config) changes.

cph-typst:
- World resolves any @preview/* package from the in-repo vendored dir
  (<render_dir>/vendor/typst-packages/preview/<name>/<version>/), fully offline —
  no typst-kit download. Proven: build_pdf_with_real_render compiles the real
  render package (which imports @preview/numbly:0.1.0) through the embedded
  engine, PDF out.
- Driver threads each target's presentation config: looks up the TargetConfig by
  name, emits `config: (numbering: (heading: (...)))` (escaped) when an override
  is present, else `config: (:)` (render default).
- target_precheck guards artifact/target: FileTree → blocking diagnostic (MVP is
  single-file, deferred per ADR-0009); --target not declared → blocking
  diagnostic; no-targets lesson still defaults through.

cph-check:
- Migrated to Lesson.targets: Vec<TargetConfig> (target_names() / target.name at
  the 6 sites). Pipeline unchanged (already matches ADR-0010 phases). Documented
  that !has_errors() implements Spec.Courseware.Legal (no error-level diagnostic).

Workspace: fmt + clippy -D warnings + all tests green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/cph-typst/src/world.rs

@@ -12,8 +12,15 @@
 //! - **`@local/cph-render`**: a `FileId` whose root is the render package spec
 //!   is read from `render_dir.join(vpath.realize)`. This avoids installing the
 //!   package into the typst local-package directory (MVP: no environment
-//!   coupling). Any *other* `@package` id yields a `NotFound` error (the MVP
-//!   render package has no external `@preview` dependencies).
+//!   coupling).
+//! - **`@preview/<name>:<version>`**: resolved offline from the in-repo vendored
+//!   preview tree at `<render_dir>/vendor/typst-packages/preview/<name>/<version>/`
+//!   (mirroring typst's preview-cache layout). The render package imports
+//!   `@preview/numbly:0.1.0` (per-level heading numbering); reading it from the
+//!   vendored dir keeps compilation network-free with no `typst-kit` package
+//!   download. This is general — any `@preview/*` resolves from the vendored
+//!   preview dir; numbly 0.1.0 is the only one currently present.
+//! - Any *other* `@package` namespace yields a `NotFound` error.
 //!
 //! Sources are cached in a `Mutex<HashMap<FileId, Source>>` so repeated
 //! accesses during one compilation are cheap, as the `World` contract expects.
@@ -94,7 +101,8 @@ impl LessonWorld {
     }
 
     /// Map a `FileId` to its on-disk path, honoring the project / render-package
-    /// roots. Returns a `FileError` for any other package root.
+    /// / vendored-`@preview` roots. Returns a `FileError` for any other package
+    /// root.
     fn resolve(&self, id: FileId) -> FileResult<PathBuf> {
         let vpath = id.vpath();
         match id.root() {
@@ -102,6 +110,21 @@ impl LessonWorld {
             VirtualRoot::Package(spec) if *spec == self.render_spec => {
                 vpath.realize(&self.render_dir).map_err(Into::into)
             }
+            // `@preview/<name>:<version>` → vendored preview tree under the
+            // render dir. Offline, no download: mirrors typst's preview-cache
+            // layout so e.g. `@preview/numbly:0.1.0` (imported by the render
+            // package) reads from
+            // `<render_dir>/vendor/typst-packages/preview/numbly/0.1.0/`.
+            VirtualRoot::Package(spec) if spec.namespace == "preview" => {
+                let pkg_root = self
+                    .render_dir
+                    .join("vendor")
+                    .join("typst-packages")
+                    .join("preview")
+                    .join(spec.name.as_str())
+                    .join(spec.version.to_string());
+                vpath.realize(&pkg_root).map_err(Into::into)
+            }
             VirtualRoot::Package(spec) => Err(FileError::Package(
                 typst::diag::PackageError::NotFound(spec.clone()),
             )),