Address third round of Gadfly findings on #76

- hexCenters now derives its exact point count BEFORE building anything and
  returns it alongside the points, refusing over the cap without allocating.
  Previously it materialised the whole lattice and fillLoaded checked len()
  afterwards — so the "too large" path paid for the thing it was rejecting.
  This also makes the preallocation exact, which subsumes the earlier
  over-allocation finding I'd declined: staggered rows hold cols-1, so
  rows*cols over-reserved by ~12%.

- Region.empty() names the invariant that clampTo expresses "no overlap" by
  INVERTING the region rather than zeroing it. A bare `MaxX < MinX` at each
  call site was spreading a non-obvious convention across three functions.

The count is now load-bearing (it gates the cap), so the test asserts it
matches what actually gets built.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01H3zbym8Doka2d7D48maSgZ

CLAUDE.md

@@ -129,6 +129,21 @@ fix what's real → merge when the pipeline is green. Do not grade Gadfly findin
 A push to `main` builds the image and deploys to Komodo; the live instance at
 `pansy.orgrimmar.dudenhoeffer.casa` updates a few minutes later.
 
+**Gadfly reviews the PR as opened, not as merged.** The workflow triggers on
+`opened`/`reopened`/`ready_for_review` — deliberately *not* `synchronize` — so
+every commit you push afterwards, including the ones you push in response to
+Gadfly itself, is unreviewed unless you ask. Once you've stopped pushing and
+before you merge, comment **`@gadfly review`** on the PR to re-trigger it. The
+phrase is required, and this is not hypothetical: on #76 the follow-up commit
+was the one that contained a real bug.
+
+**A skipped Gadfly run reports success.** A comment without the trigger phrase
+still starts the workflow, which logs `comment does not contain trigger phrase`
+and exits green in ~2 seconds. So "the pipeline is green" does NOT mean "this
+was reviewed". Confirm a re-review actually ran by checking that it posted a new
+consensus comment — or that the run took minutes rather than seconds — not by
+its status.
+
 Workflow- and config-only changes (CI, this file, docs) go straight to `main`
 without the PR dance.