v0.10.0

A hardening release. The two changes a reader can meet are refusals: -w
stops at 1000 columns, because every rendered line is padded to the content
width and -w 65535 turned a 33 KB document into 48 MB of spaces; and only
http:, https:, mailto: and local paths reach the system opener, because
a link's scheme picks which program runs and a document does not get to pick
programs. Around them, CLICOLOR_FORCE keeps color in a pipe, a file in the
wrong encoding renders instead of erroring, and every release archive and
package now carries the man pages and completions.

Added

• CLICOLOR_FORCE=1 (or FORCE_COLOR=1) forces color into a pipe, so
  marquee-markdown doc.md | less -R keeps its color, and TERM=dumb now
  gets plain text — no color, no OSC 8 hyperlinks, no centering — which is
  what an editor's embedded shell is asking for. NO_COLOR still wins over
  everything; it is the reader's own hand on the switch.

Changed

• -w is capped at 1000 columns, and -w 0 ("do not wrap") renders at
  that cap rather than at 16,383 columns. Every rendered line is padded to
  exactly the content width, so the width bounds the output size directly:
  -w 65535 turned a 33 KB document into 48 MB of mostly spaces. The flag
  refuses larger values; a config file's width is clamped.
• Only http:, https:, and mailto: links, and local paths, are handed
  to the system opener. A link with any other scheme — file:, a protocol
  handler some application registered — is refused with a message: a scheme
  picks which program runs, and a document does not get to pick programs,
  however deliberate the keypress that followed it.
• The Debian and RPM packages ship man pages and shell completions for
  both binaries, in the paths the distributions document, and every release
  archive now carries them too — including the cross-compiled macOS build and
  the Windows zip, which used to go without. The .deb gains a real extended
  description in place of the raw README and drops its duplicate LICENSE
  (the generated copyright file already carries it); the RPM marks the
  README as documentation.
• The crate description keeps to the strictest packaging rules any channel
  applies — under 80 characters, no leading article — because it is also
  the Debian synopsis, the RPM summary, the Homebrew desc, and the Scoop
  description. It was 98 characters with a leading "A ", which lintian
  rejects outright. A test now holds all four spellings together.
• The release workflow's token is read-only except where the release is
  published, third-party actions included; the checkout action is on the
  same major as CI's, and the changelog-notes heredoc uses a random delimiter
  so no changelog line can truncate it.

Fixed

• A local file in the wrong encoding renders instead of erroring. A
  Latin-1 document was refused with "stream did not contain valid UTF-8"
  while the same bytes fetched from a URL rendered fine; both now render with
  replacement characters. Actual binary data — an image opened by mistake —
  gets "is not a text file" rather than either a decoder error or a screenful
  of mojibake, from a file, a URL, or standard input alike.
• EDITOR, VISUAL, and PAGER settings may quote a path with spaces.
  EDITOR='"C:\Program Files\Editor\edit.exe" -w' used to try to run a
  program called C:\Program.
• A document with no links no longer pays a full metadata scan every
  frame. The link collector's memo tested its entries for emptiness to
  decide whether it had run, and a link-free document is also empty, so it
  re-collected once per keystroke.
• A remote document of exactly 8 MiB is accepted. It used to be rejected
  as "larger than 8 MiB", which it is not.
• Two READMEs whose names differ only in case pick the same file every
  run. The choice fell to whichever name the directory listing happened to
  yield first; byte order now breaks the tie the priority list cannot.
• Overlapping terminal pauses can no longer reopen the gate early. The
  handshake that stands the terminal reader down tracked "paused" as a flag,
  so the first of two overlapping pauses to end would have resumed input
  under the second. Unreachable with today's callers, but that was a fact
  about the callers, not a guarantee; it is a count now.

Documentation

• SECURITY.md no longer claims remote documents are HTTPS-only (plain
  http:// is fetched as given) or that raw HTML is always shown literally
  (the default mode renders a recognized subset as styled text); it now also
  records the link-scheme allowlist. docs/ROADMAP.md records the absence of
  BiDi reordering as a known gap. AGENTS.md names syntect's actual feature
  set.