v0.2.1 — web bridge hotfix

FireCraft v0.2.1 — hotfix release

v0.2.0's web bundle shipped with a dead browser bridge: File > Open,
Import, and Save did nothing in the browser (the wasm shell panicked
on its first bridge call), and the build-time smoke check that should
have caught it was reading its own script source instead of the page's
runtime state — green while broken. This release replaces the v0.2.0
web zip. Desktop and CLI artifacts are unchanged in behavior; all
artifacts are re-cut at the new version.

Fixed:

• web: the eframe shell now overrides the wasm-only as_any_mut entry,
  so bridge calls (postMessage open/apply/export, the hidden file
  input, downloads) reach the app instead of panicking.
• web: bridge-driven mutations now repaint the canvas — an opened
  document renders immediately, with zero input events.
• build: the dist --web bridge smoke strips <script> bodies before
  asserting on the DOM and also requires the failure marker's
  absence; it can no longer pass on its own inputs.
• build: the fmt gate now covers the workspace-excluded web crate.

The deployed instance at https://firecraft-web.pages.dev serves this
release and was verified in a real browser: open (menu and host-page
bridge) -> draw -> save, end to end.

Carried from v0.2.0 (full notes in the v0.2.0 release):

• Shell surfaces M13 (CS6 tool panel, align/distribute, point editing,
  Auto Shape library), live filters M14 (24 kernels, CS6 filter
  enumeration parity), style/vector depth M15 (gradient styles,
  compound paths, masks).
• CS6 DOM verb-surface parity: 268 covered / 3 refused with recorded
  evidence / 0 missing; 241-command engine registry.
• Native WebP encode (lossless) and WebP import; PNG/JPEG round trip;
  SVG export with golden parity.

Platforms: this release was built and verified on Linux x86_64
(desktop tarball, CLI tarball, deb, WASM bundle). The web bundle is
the primary release target. Other platform recipes live in the repo.

Web bundle: serve the unzipped contents over HTTP(S) (any static
server); opening documents and saving use the browser's file dialogs
via a hidden input and blob downloads, and hosts can drive the app
with postMessage (ping/openDocument/exportRequest — see docs/WEBOS.md).

SHA-256:
665002a62a4ff893b2781e72724ef595af71f73b3d7445f81d4a0d1ac70459a7 dist/native/firecraft-0.2.1-linux-x86_64.tar.gz
9a56579ed151c9ba21aad381e2ec9d3df269c4493e6254aac171a5c7e836a02a dist/native/firecraft-cli-0.2.1-linux-x86_64.tar.gz
d7b919ff563b2e2e0f53101094a3ca14ee240e464f3671d6c6990af8bfd22d9e dist/firecraft-web-0.2.1.zip
74188dd5121da965efbfb41979ac623d706d0b48665514103fe2fb40fbd27aff dist/native/firecraft_0.2.1_amd64.deb
68ca3a2f91ed5cdcbc90837fd20f19810a67fc66a18121d3d903b7dd4545defc dist/native/MANIFEST.sha256