panics are bad mmkay

https://blog.cloudflare.com/18-november-2025-outage/#:~:text=panicked%3A%20called%20Result%3A%3A-,unwrap,-%28%29%20on%20an%20Err remind us that panics are not fun, particularly in code that might be pushed to prod servers or end user devices. We should seek to avoid all practices that lead to panic, such as unwrap, assert, expect, etc.

Mitigations include:

1. `#![clippy(deny::unwrap_used)]`, suggested by @simoncozens
1. https://rust-lang.github.io/rust-clippy/master/index.html#/disallowed_macros to block asserts

We can implement incrementally. In prioritized order:

- [ ] Skrifa and anything it depends on, because it's live in Chrome
- [ ] HarfRust and anything it depends on, because we'd like it to one day be live in Chrome
- [ ] klippa, because we will use it in our own servers
- [ ] The entirety of fontations, because we ship things to our own servers and various other places
- [ ] The entirety of fontc, because we might want to run it on servers
* #1690 complains of panic in fontdrasil. fontc has a lot of additional opportunities.

Start by reviewing the Clippy configuration and the Skrifa dependency tree, then identify how unwrap, assert, and expect are currently handled. The issue proposes incremental coverage, beginning with Skrifa and its dependencies, followed by HarfRust, klippa, fontations, and fontc. Done means the prioritized components avoid or explicitly block the listed panic-prone practices.

Written by the indexing model from the issue text.