No way to detect an unresolved font family; the fallback is silent

[msallin]

SystemWorld::new (world.rs:79-83) adds system fonts when enabled and always adds the embedded ones. An unresolved family is substituted from those fallbacks, a warning is emitted, and the compile succeeds. The suite depends on this: WarningSource uses #set text(font: "No Such Font Family").

In a service the warning is a plain string in Warnings, indistinguishable from any other. In a minimal container image, which usually has no fonts installed, every document renders in a fallback face with different metrics, line breaks and page count than the approved proofs, and the return value does not say so. It works on a developer machine where the font is installed system-wide, and changes silently on the build agent and in production.

What I would like:

1. Expose the unresolved families, or give warnings enough structure that a caller can treat "unknown font family" as an error without matching on strings. Overlaps Suggestion: Instead of throwing exception on errors returned from Typst library, return an error object #24.
2. A README note on fonts in containers, recommending new Fonts(IncludeSystemFonts: false, FontPaths: ["/app/fonts"]) for deterministic output across Windows and Linux. This matters for PDF/A as well, since embedding depends on the face actually used.
3. A strict mode on Fonts that turns an unresolved family into a compilation error.