v0.3.2 — security: enforce plain text at the render site

Security fix — completes the incomplete fix in v0.3.1. Reported again by @ryanrhughes.

v0.3.1 sanitised the data reaching the bar pill but left the render site on Qt's Text.AutoText default, because WidgetButton's label is a private Text whose textFormat cannot be set from outside the component. That made the guarantee depend on every upstream producer sanitising correctly, forever.

The pill now suppresses WidgetButton's own label and paints its own Text with textFormat: Text.PlainText, so enforcement lives in this snapshot rather than upstream. Model.plain() strips markup at assembly as a second layer, and the Ruby-side sanitisation is the third. Every Text in the panel sets PlainText explicitly.