pdfce v0.27.0 - redaction removes everything under a mark: images destroyed, vector paths cut

Workspace version 0.17.0 -> 0.27.0 on GitHub (ten workspace versions;
v0.18.0 through v0.26.0 were deployed to OneDrive without a GitHub
release). The asset is the single-folder portable build: unzip anywhere,
run pdfce-gui.exe or pdfce-cli.exe, no installer, nothing written
outside the folder.

WHAT AN OPERATOR GETS IN v0.26.0 AND v0.27.0

REDACTION NOW REMOVES EVERYTHING UNDER A MARK. Before v0.26.0 a redaction
mark that so much as touched an image's rectangle refused the whole apply
-- "it tells me it can't because there are objects that weren't
redacted" -- and a title-block value inches from a company logo could not
be redacted at all. Now:

• An image under a mark has the covered pixels DESTROYED, not hidden:
  decoded (raw, JPEG, CCITT, JBIG2, JPEG 2000), the cells overwritten with
  paper, re-encoded losslessly. Its soft mask goes transparent over the
  same cells, because a mask's shape can reveal a signature on its own.
• An image the mark covers entirely is removed from the page outright.
• An image also drawn elsewhere (another page, a form, an unmarked spot on
  the same page) gets a copy for the marked placement; the original stays
  for the others, and the report says so.
• Vector lines, curves and fills crossing a mark are CUT at the boundary
  (v0.27.0): strokes against the mark widened by their stroke width,
  fills clipped to the mark's complement, anything wholly inside deleted.
  Acrobat clips or rasterises here; pdfce excises the geometry.
• A mark over an image pdfce cannot decode is RETAINED in the output as an
  unapplied mark -- nothing removed under it, no box drawn over it -- and
  every other mark still applies. Refusal is per mark, not per document;
  only when no mark at all can be applied does the run refuse.
• A shading (sh) whose clip meets a mark is counted and disclosed (not
  cut yet).

Whole-page marks on the two image-bearing drawings that reproduced the
refusal now exit clean with a blank page (780 and 1,089 path objects
dropped); a corner mark cuts 25 objects and 195,960 image cells in 0.3 s.

A PIXEL-LEVEL PROOF NOW GUARDS REDACTION. The test suite rasterises an
applied redaction and asserts nothing is inked inside the mark. It caught a
defect that twenty-two byte-level tests agreed with: destroyed image cells
were black inside a transparent mark. They are paper now.

The redact-apply report gained ten counters (images_cleared,
images_removed, images_cloned_shared, images_overcovered,
marks_retained, vector_paths_cut, vector_paths_dropped,
vector_clips_kept, vector_paths_intersecting, shadings_intersecting)
and three carriers (images, vector_paths, shadings). A non-zero
marks_retained means the output still carries marks.

SINCE THE LAST GITHUB RELEASE (v0.18.0 - v0.25.0, previously OneDrive only)

• PRINT COLOUR IS COLOUR-MANAGED ON EVERY ROUTE: ICC-based RGB and CMYK,
  Lab, CalRGB and CalGray fills, text, images, indexed images, shadings and
  meshes all convert through the embedded profile or the page's output
  intent. Spot inks have their own plane through images, stencil masks,
  shadings, transparency and knockout groups. The print-conformance sweep
  that stood at 5 failures is at 0.
• The overprint zero-tint default follows the literal ISO 32000-1 reading
  now that spot inks have a plane (OverprintZeroTintScope, a setting).
• Vectors can be recoloured; a spot-inked path is refused by name rather
  than destroyed. Geometry inside a form XObject is editable.
• A page's tab order can be set. A link says where it goes, not only what
  kind of action it carries. A button's action can be read back.
• Form widgets: a resized widget is redrawn at the new size; an auto-sized
  field fills at the size its box implies; submit/reset/show-hide buttons
  with the safeguards the plan named; renaming a field reports the buttons
  it breaks.
• Every content-editing verb reads the live session, not the file on disk.

COMPATIBILITY

• RedactError::ImageRegion no longer exists (v0.26.0); the new variant is
  ImageUndestroyable { page, reason }, raised only when nothing could be
  applied. Code matching other => is unaffected.
• redact-apply exits non-zero on a disclosed residual as before; on a
  well-formed drawing with no shadings under the mark there is no residual
  now, so the exit code drops from 10 to 0 where it used to trip.
• Destroyed image cells render as paper (white for grey/RGB, no ink for
  CMYK), not black. A black box appears only when the mark carries an /IC.

VERIFIED

cargo test --workspace 5,090 / 0; cargo fmt --check and
cargo clippy --workspace --all-targets --all-features -D warnings clean;
cargo check for wasm32-unknown-unknown; cd fuzz && cargo check --bins;
cargo tree -p pdfce-core -p pdfce-render free of any GUI or network
dependency; the full script gate sweep including both filing gates; fuzz
target 15 (redact_apply) 14,796 runs / 0 crashes; fresh-folder smoke test
of both binaries from the packaged folder; CI green at the release tip.