v0.2.0 — the captchas this site serves are solved now

If you read 0.1.0's notes, two claims in them are now false. A 2Captcha
key does clear this site's challenges — both of them — and the canary is
dispatch-only rather than daily.

Everything in this release is about the same thing: what this scraper does
when foodpanda refuses it. 0.1.0 shipped saying a key would not help. That
was wrong in the way that matters most — it reported a limit of this code as
a limit of the product.

Both of this site's challenges are solved now

	task type	measured
reCAPTCHA Enterprise on PerimeterX's denial page	RecaptchaV2EnterpriseTaskProxyless	~55s, $0.00299, page came back with its full grid
Cloudflare Turnstile, Challenge page included	TurnstileTaskProxyless	11s, $0.00145, 837-char token, page became the real site

The enterprise solve has a control, because a solve that coincides with a
block expiring proves nothing: a plain same-session reload cleared the same
block 0 of 8 times. The token is what got in.

The Turnstile half is harder than it looks. A Challenge page publishes no
sitekey at all — Cloudflare calls turnstile.render(container, params) once
and keeps nothing, so cData, chlPageData and action exist only inside
that call. Every engine now installs an interception script on the context
before any page script runs: add_init_script in Playwright,
evaluateOnNewDocument in pyppeteer, CDP
Page.addScriptToEvaluateOnNewDocument in Selenium — the one thing the three
cannot share.

Still unsolvable, and honestly so: PerimeterX's widget-less stub. 4.7 KB,
24 px-captcha references, no widget at all. Nothing there for any solver at
any price, so nothing is attempted or billed for it.

Changed

• A page with a solvable widget is challenge, not blocked. Both of
  this site's refusals carry one now.
• The canary is dispatch-only: no schedule, no badge. This repo runs
  nothing live on a timer, and a green badge for a check that is not
  happening is as unreadable as one that is always red.

Fixed

• A wrong captcha variant, found by spending real money on the first
  attempt — no rung for "challenge frame present, no size, no render",
  so it fell through to v3 and got ERROR_CAPTCHA_UNSOLVABLE after 87
  seconds. v3 renders no challenge frame at all, so a frame present now
  settles the variant.
• The static detector could not see this site's widget — it bailed unless
  the markup contained grecaptcha, and the denial page carries only the
  hyphenated class g-recaptcha. Anyone debugging from a --dump-html
  capture was told there was no captcha at all.
• cf-turnstile was tried as a marker and thrown away. 2Captcha's
  Scraping Browser injects a cf-turnstile-response hunter into every page it
  loads, so the string appears once on a served listing and zero times
  on the real challenge — a marker that fires on good pages and misses the bad
  one. challenges.cloudflare.com is the one that works: 0 on every served
  page, 5 on the challenge.
• A sitekey-less Turnstile detection raises instead of building a task.
  Paying for a request 2Captcha will reject is worse than reporting the page
  unsolved.

Tests

493 offline checks, up from 470, none of which touch the site or a
credential.