v0.50.0 — a damaged PDF opens, and a redaction stops leaking

v0.50.0 — a damaged PDF opens, and a redaction stops leaking

Ten Passes since v0.49.0. Two changed a posture rather than a behaviour.

A PDF WITH ERRORS OPENS (Pass 283.0, decision 145, R248). Six malformation
classes that used to cost the whole document now open instead: a duplicate
dictionary key, a missing or unusable stream /Length, a missing endobj, an
object that will not parse, an xref/body disagreement, an unreadable object
stream. Every decision is recorded with what it chose BETWEEN, and
--on-malformed takes the other one. Fail-clean never meant refuse.

REDACTION SWEEPS THE FILE, NOT THE GRAPH (Pass 284.0/285.0, decision 146,
R249). Carriers were found by navigating the document graph while the
writer emits objects by enumerating the cross-reference table; everything
in the difference was copied through verbatim while the report said
"scrubbed". Measured at 12 of 57 files on a real drawing set. A new
fourteenth carrier sweeps every object by EVIDENCE -- never by computing
reachability, which fails silently.

Also: /Ink strokes are editable per point and per stroke; hybrid-reference
files are rewritten so redaction reaches them; run_repertoire answers which
characters a run accepts before the first keystroke; a sticky note declines
a resize as what it is; and the redaction report carries the words a mark
covered rather than one entry per show operator.