fonts: remove bundled binary payloads

docs/PROVENANCE.md

@@ -46,25 +46,31 @@ new SKK revision.
 
 ## Fonts
 
-The popup bundles Noto Sans, Japanese-region Noto Sans Mono CJK, and Noto
-Emoji.  Exact checksums, versions or source revisions, download locations
-where known, fallback order, and license-file names are recorded in
-`font/PROVENANCE`.  The corresponding OFL 1.1 and Apache 2.0 texts are kept
-beside the fonts.
+No font binaries are bundled.  The daemon receives one to four font file paths
+on its command line and tries them in that order; it does not discover fonts by
+family name or directory contents.  `font/PROVENANCE` retains the exact
+checksums, source revisions, and license records for the three Noto faces that
+were formerly stored in the repository.
 
-## stb_truetype
+The Docker renderer tests obtain their fonts from signed Arch packages rather
+than the source checkout.  On August 13, 2026 the tested package contract was:
 
-`stb_truetype.h` is Sean Barrett's stb_truetype version 1.26, dated
-August 28, 2021 in its header.  Its exact repository checksum is:
+- `ttf-dejavu` `2.37+18+g9b5d1b2f-8`, providing
+  `/usr/share/fonts/TTF/DejaVuSans.ttf` (SHA-256
+  `6038a160b491e121c1f12c7bccb4a9c8730296e3adc1086a059404ed84b7451c`);
+- `ttf-jigmo` `20250912-1`, providing
+  `/usr/share/fonts/TTF/Jigmo.ttf` (SHA-256
+  `c8f295b9bd8f9f117a76b3a454aaaa1bb5b4babc18e254978c6deb88464e40cf`)
+  and `/usr/share/fonts/TTF/Jigmo2.ttf` (SHA-256
+  `5da3582efe77e22073b86b3b86b556d7111148a76b957cfb53318a91da2efff0`).
 
-```text
-ecd30b05e0dd4fea3a13c26810dd9e1992dc379049482c393d5a19e6b5090aab
-```
-
-The file was present in the repository's first commit,
-`dcd1147638f908eca7e4b7616815e215022cc99d`.  No upstream commit or download
-URL was recorded.  Its complete dual MIT/Public Domain terms are retained at
-the end of the header.
+Pacman validates the package checksums and repository signatures.  DejaVu Sans
+supplies ASCII and the monochrome U+1F600 outline in the tests; Jigmo supplies
+Hangul and BMP CJK, and Jigmo2 supplies U+2000B.  Their installed license files
+are `/usr/share/licenses/ttf-dejavu/LICENSE` and
+`/usr/share/licenses/ttf-jigmo/LICENSE.txt`; the packages identify their terms
+as the DejaVu custom license and CC0 1.0, respectively.  These packages are
+test fixtures, not names or paths hard-coded into the daemon.
 
 ## Generated Wayland protocol code