v0.9.0: comments that name the author go, apostrophes stop meaning provenance

• HTML and Markdown lose the comments that say who wrote them. A <!-- generated by ChatGPT --> survived cleaning in both formats; only SVG handled provenance comments. guillaumemeyer/watermarks-remover#366 reports and drops a <!-- --> comment that names an AI tool or says AI-generated, C2PA or content credential, so a static site generator's own comment and a <!-- toc --> marker stay. In Markdown, comments inside a fenced code block are left alone, with CommonMark's rules for where a fence opens and closes: a line such as ``` not a close does not end one, and a backtick fence whose info string holds a backtick is not a fence. The fence scanner is written out by hand rather than with a multiline regex, because JavaScript's ^ and $ also hold at a lone carriage return and at U+2028, where Python's hold only at a line feed.
• An apostrophe no longer turns a page description into provenance. <meta name="description" content="Bob's favorite Claude Code skills"> was reported as AI metadata and deleted: the attribute patterns stopped a value at either quote character, so the value was never blanked and "Claude" was matched as a name. #373 reads a value up to its real closing quote. It cuts the other way too: content="Bob's C2PA manifest" used to parse as Bob and now flags.
• Marker bytes inside a complete video or image are no longer a C2PA finding. Coded media contains short ASCII strings like jumb or c2pa by chance, and inspection fell back to scanning the whole file for them even when every box had parsed. #371 keeps that scan only for a box walk that stopped early, a truncated download, which is what it was for. Both drivers follow it, and the slice driver gains the most: inspecting a complete 128 MiB MP4 used to read the file twice over (256 MiB, 395 ms in Node); it now reads 176 bytes of box headers and takes under a millisecond.
• The U+0130 divergence is over. Upstream fixed #354 in #364 the same way this port always worked, lowercasing ASCII only. The two tests that asserted the divergence in both directions now assert agreement on the inputs that used to separate them.
• js/pyre.js translates . and \d the way CPython reads them. Python's . refuses only a line feed, where JavaScript's also refuses a carriage return, U+2028 and U+2029; Python's \d matches any Unicode decimal digit, where JavaScript's is ASCII. The new patterns were the first to lean on either, and four of the new fixtures fail, in inspect and in clean, without the translation.
• 1691 tests, twelve upstream anchors, five of them moved to upstream 258cf20.

Ports upstream guillaumemeyer/watermarks-remover at 258cf20. Closes #29.