Own the encoder and the digest, and cut what a caller links by two thirds

[timzifer]

blazon told callers it had no dependencies, which was true of go.mod and not
of what it put in their binaries. A program whose whole job is to turn a
version string into one small picture was linking a general-purpose
compressor, a general-purpose compositor, the FIPS-140 module and the
reflection runtime to do it.

All four are gone. Nothing a version renders to has changed — the committed
gallery is byte-identical, and the marks now come out the same under gc and
under LLVM.

What replaced them

Was	Is	Why it was never a real dependency
image/png, compress/flate, hash/crc32	internal/pngenc	A fixed-Huffman deflate stream with LZ77 and per-row filters. The committed gallery grows 0.4%.
crypto/sha256	internal/sha256	Same digests, so every mark is unchanged. The standard library's version now arrives behind the FIPS-140 module's self-tests and entropy sources.
image/draw	canvas.fillRect, blazontest.blit	Two uniform fills and one blit were the entire use of a general-purpose compositor.
fmt, and with it reflect	string assembly	Every value the SVG back end formatted was already a string. The format verbs were decorative; the reflection behind them was not.
sort, encoding/binary	slices.Sort, byte shifts	Both import reflect, which is what actually cost the kilobytes.

version.go keeps errors.Is(err, ErrSyntax) working through a syntaxError
that wraps it, and its messages are byte-identical to what fmt.Errorf
produced.

What it costs a caller

Measured on internal/sizeprobe, the smallest program that renders a mark:

	before	after
gc, -s -w	2,444,288	1,783,808
TinyGo, wasip1	1,011,974	785,684
above an empty Go binary	947 KB	287 KB

Keeping it that way

Two new rules, because these imports come back by accident and nothing else
would notice — one fmt.Errorf on an image type is enough.

• TestNoHeavyStandardLibraryImports fails the build if any of them reappears
  in what a caller links. blazontest and cmd/blazon are exempt: their
  callers already link testing or flag.
• A new tinygo CI leg weighs internal/sizeprobe against a byte budget, and
  renders 1.4.2 under both compilers to compare the files byte for byte. gc
  and LLVM are not obliged to agree about floats and the renderers are full of
  them; today they agree exactly, including for the float-heavy default
  renderer.

The root package's suite is left out of the TinyGo run — it renders whole
corpora and exhausts the wasm heap. TestRegisterRejectsDuplicates moves
behind a !tinygo tag: TinyGo's recover does not catch a panic from another
function and its t.Skip does not unwind, so the test would take the process
down instead of reporting.

Released as 0.2.0, with the logo regenerated for that version.

🤖 Generated with Claude Code

https://claude.ai/code/session_019RJ8FUiT1YvbBz3D2PriM9