Fullbleed 2.5.20: deferred clipping fixes

Fullbleed 2.5.20 fixes filtered and positive-z-index content escaping an ancestor's overflow clip. Rounded panels now keep their filtered children inside the clipping edge, including nested clips, transforms, one-axis clipping, and clip margins. Overflow still preserves the surrounding stacking order.

The release also keeps reusable drawing resources ahead of deferred painting, fixing filtered positive-z-index children that could fail to render.

Validation: 1,355 Rust library tests, 11 documentation tests, 591 Python tests, and Windows/Linux CI. Sixteen Chrome-verified cases pass 209 pixel checks across 35 PDFs, covering direct, compiled, repeated, fixed-binding, and reflow output. The public PyPI wheel reproduces all 35 PDFs; a fresh crates.io consumer produces 32 identical direct/compiled PDFs on Windows' unchanged main stack.

The complete unchanged 1,662-fixture source corpus reports 1618 PASS, 25 FAIL, and 19 REFERENCE-DISPUTED, with no new FAIL or lost PASS verdicts. Only the clipping fixture changed, moving from FAIL to PASS; the other 1,661 PDFs are byte-for-byte unchanged. Its remaining failed gate is preserved in the evidence. This corpus uses the identified source candidate; the public wheel has the separate targeted verification above. These checks do not establish general CSS parity or PDF standards conformance.

• PyPI 2.5.20
• crates.io 2.5.20
• PDFs, previews, regression inputs, and runnable verification
• Complete unchanged source-corpus evidence
• Verification record
• SHA-256 checksums

Source: #65. Release preparation: #66. Related to the open CSS tracker #54.