iris: ScrollArea measures its content instead of drawing it twice

A container that probes a child's size was still doing it with a real
draw, so `Painter::measure` existed and almost nothing used it. Tracing
every draw of one streamed frame: 1,083 `Widget::draw` calls over 113
distinct widgets, the worst drawn 11 times at nesting depth 7-8, every
one of them mode `Draw` and none of them dirty. The cache was working --
each of the 11 was offered a genuinely different region, alternating
between an oversized probe box and a real one.

ScrollArea::draw was one of the two sources. It drew its whole content
at a box built from a stale hint, read the length back, corrected the
scroll position, and drew the content again where it belonged. The first
of those is now a measurement.

The other half is the measure fast path. A widget's reported size is a
function of its own state and the size it was offered, not of where it
was offered -- so an undirtied widget already drawn at a region of this
size has already answered, and `active.size` is the answer. This is the
same assumption `mov` makes one branch further down (same offered size,
therefore identical output, therefore a translation); it is only stated
as a size here rather than acted on as a move. Without it a measurement
costs a full recursive walk, which is what made the nesting compound.

A measurement now also peeks at the redraw mark instead of consuming it
-- it is not the redraw the mark asked for, and swallowing it would
leave the widget stale until something marked it again.

453 draws from 1,083, and the streamed frame is p50 1.18ms (from 1.22ms,
and 2.20ms before this run of work). The headless phone render is
byte-identical to the previous commit's on the real GPU.

What is deliberately NOT here: the same change to `Span::draw`'s phase 1,
which is the remaining 2x and which moves the layout by a few pixels.
The layout stays intact -- it is a position difference, not a broken
frame -- but which of the two is correct was not established, and the
suspicion (that phase 2 now takes `mov`, and `mov` accumulates deltas
where a redraw recomputes) points at a bug in `mov` rather than in
`Span`. Written up in docs/IRIS_TODO.md with Iris's target shape for
`Span`: no probe phase at all for `abs` children, and a `rest` child
forcing a reposition pass rather than a redraw.

docs/IRIS_TODO.md

@@ -12,6 +12,49 @@ and six phone-report sections went on 2026-09-08 for that reason.
 
 ## Fix
 
+- [ ] **`Span` draws every child twice, and making the first one a
+  measurement moves the layout.** Found 2026-09-09; the safe half landed
+  and this is the part that needs a decision.
+
+  `Span::draw`'s phase 1 draws each child at `UiRegion::FULL` purely to
+  learn its length along the axis, then phase 2 draws it at its real
+  share. The provisional slot is the whole span, so it is wrong by
+  construction for every child, and the doubling compounds through nested
+  spans: one streamed frame of the bench fixture made **1,083
+  `Widget::draw` calls over 113 distinct widgets** before `ScrollArea`'s
+  probe became a `Painter::measure`, and **453** after, with 102 of the
+  113 still at 4 draws (2 real, 2 measurements).
+
+  Changing phase 1 to `painter.measure(child, UiRegion::FULL)` takes it
+  to 2, and **it renders differently**: 28,771 pixels, and the headless
+  phone shot shows the transcript shifted a few pixels vertically. The
+  layout is intact -- panels, code fences and text all draw correctly --
+  so this is a position difference, not a broken frame, but which of the
+  two is *right* was not established and it must be before this lands.
+
+  The mechanism to check first. With phase 1 drawing, the child's
+  `active.region` is the full span when phase 2 asks, so phase 2 always
+  finds a different size and does a real redraw. With phase 1 measuring,
+  `active.region` is still *last frame's* share, which usually matches,
+  so phase 2 takes `draw_inner`'s `mov` branch -- one `move_offsets`
+  write instead of a redraw, which is the intended win. But `mov`
+  accumulates (`entry.delta += delta`) where a redraw recomputes from
+  scratch, so the suspicion is float drift that phase 1's unconditional
+  redraw was hiding. If that is it, the fix is in `mov`, not in `Span`.
+
+  Iris's framing, which is the target shape (2026-09-09): *"if you draw
+  one child in a list of fixed sized children, then you know immediately
+  where the second one must be and shouldn't need to probe its size
+  again. The only time redraws should actually be needed are if you're
+  using a `rest` length, where you don't know how long it's gonna be
+  until you draw everything else first, and so you have to move things.
+  Even then it should just be moving, not redrawing."* So the endpoint is
+  no probe phase at all for `abs` children -- draw each in turn at
+  `[cursor, end]`, read its length, advance the cursor -- with a `rest`
+  child forcing a reposition pass over what follows it rather than a
+  redraw. `Aligned` already has exactly this shape (one draw, then
+  `Painter::reposition`) and is the example to copy.
+
 - [ ] **A row moving because the list grew should be one `move_offsets`
   write, and today it is a redraw.** Found 2026-09-09 by
   `scripts/rigs/ui-profile`'s `arena_churn` and left for whoever picks