- Add `fonts download` and `fonts verify` subcommands
- Implement Rust-based downloader (ureq + tar + flate2) with pinned sources
- Verify SHA-256 for Liberation and Noto Sans TTFs for reproducibility
- Keep binary behind `build-bin` feature; library build unaffected
Expose a `docx-mcp fonts download` subcommand that runs the existing `download_fonts.sh` helper, so users can fetch the embedded fonts via the binary. Keeps existing flags intact and avoids build-time network coupling.