os/v3/puppy: the console TUI's QR takes the panel grid's rows and paints over the MENU rule at 104x29 #980

Landed by #962 (the console TUI's clickable URLs + QR + mDNS name), measured on the merged tree (eda7542e) with the static binary.

Reproducer

cd os/v3/puppy/console-tui && ./build-static.sh
# blank key (the shipped mode: six CONNECT rows, the widest block) at a plain ssh size
./target/x86_64-unknown-linux-musl/release/1bit-console-tui --snapshot 104x29   # live facts
# or in a pty: tmux new-session -d -x 104 -y 29 'TERM=linux <that binary>'

Before:

  api  http://192.168.50.110:13305/api/v1                                 █▀▀▀▀▀█ ▄ █ ▀█▄▄  █▀▀▀▀▀█
  ssh  root@192.168.50.110   (your key in /data/ssh/authorized_keys)      █ ███ █ ▄▄▄ █▄ █▄ █ ███ █
 MENU ----------------------------------------------------------------                                 -

LEMONADE, GPU, NPU, MODELS, FANS / TEMPS, DATA and the log pane are gone, and the code's bottom
quiet zone is painted over the MENU rule (the rule comes back as MENU ---- -).

Root cause

qr_panel() decided the rows itself with a hand-counted constant — h < rows.len() + 12, documented as "the panels,
the nine menu rows, three log rows and the footer". At 104x29 the width test passes (the block's widest row is 64
columns, the code 33), so the code was drawn, top was padded to 19 rows, and the real total (19 + 9 panel rows + 10
menu rows + 2 log rows + 1 footer = 41) exceeded the 29-row terminal. Layout::vertical with Length constraints
then gave the panel grid zero height and shifted the rows under the code.

The row budget is the caller's question: only draw() knows the panel grid, the menu and the footer it is about to
draw.

Fix

qr_panel() no longer takes h; draw() builds the footer, the facts block and the nine menu rows first and draws
the code only when padded_top + facts + menu + 2 + footer <= h. Where it does not fit the URLs stay plain text,
which is what the module already promised ("absent rather than squeezed"). New test
the_qr_never_costs_another_block_a_row sweeps 101x29, 104x29, 104x33, 104x39, 110x34, 120x40, 140x40 and 240x67 in
the blank mode and requires: the frame is exactly the terminal, the footer is on the last row, no rule has a hole in
it, the panel grid is present at every width >= 100, all nine actions are there, and the code IS still drawn at
240x67. It fails on the old budget (MERGE-time regression check: reverting only the budget line makes it red at
104x29) and passes with the fix. The two committed snapshots are byte-identical — 240x67 still has room.

Measured after: 104x29 shows the full panel grid and a whole MENU rule, no code; 104x42 (where it fits) and 240x67
still draw it; q over ssh still exits 0 with icanon/echo restored, Ctrl-C on the console still refuses to exit.