fix: rename the typeface inside the files, not only in the stylesheet

[isaacslee]

Found by auditing the package rather than the source. The shipped fonts named
themselves:

dist/images/quiet-sans-latin.woff2
    Family      'Pretendard Variable'
    Full name   'Pretendard Variable'
    PostScript  'PretendardVariable-Regular'
    Unique ID   '1.309;CTUS;PretendardVariable'

Pretendard is OFL 1.1 with a Reserved Font Name. Clause 3 bars a modified
version from carrying that name as the one presented to users, and a subset is a
modified version. Three releases went out this way.

Why it slipped

Everything around it said the rename had happened. scripts/font.mjs had
FAMILY = "Quiet Sans"; its comment said "The family is renamed";
THIRD-PARTY-NOTICES.md said the rename was required and done. The one thing
that had actually changed was the @font-face declaration — which names the
file CSS loads, not the font inside it.

FAMILY was only ever a label on the returned object. It was never passed to
subsetFont, and could not have been: subset-font has no rename option, only
preserveNameIds for which records to keep.

The fix

scripts/font-rename.mjs rebuilds the name table between subsetting and
compression. The subset is taken uncompressed, renamed, then put back to woff2
through fontverter — which subset-font already uses internally for the same
conversion, now declared as a direct dependency since the build calls it.

Renamed: family, full name, PostScript name, unique id, typographic/WWS
families, and the PostScript name of all nine named instances.

Not renamed: copyright, trademark, licence, licence url. The restriction is on
the name the font presents, not the credit it carries — stripping "Pretendard"
out of the copyright line would break the licence in the course of complying
with it. Name ids 13 and 14 are now preserved too, so the licence travels inside
the font as well as beside it; harfbuzz drops both by default.

Validation

node scripts/check.mjs — 26 checks, passed.

New check, the typeface ships under its own name, reads the built files back
rather than trusting the script — a constant in the script is exactly the
evidence that failed last time. Proved to fail by rebuilding the font the old
way and running the gate against it:

- the typeface ships under its own name: quiet-sans-latin.woff2 still presents
  "Pretendard Variable" (name id 1); ... is family "Pretendard Variable", not
  "Quiet Sans"

The rename changes nothing else. Old and new subsets of the same text,
compared table by table: every table is byte-identical except name and head,
and head differs only in checkSumAdjustment, which this recomputes. Glyph
count, unitsPerEm, the wght axis (45–930, default 400) and all nine named
instances are unchanged.

Rendering checked in the browser against the shipped @font-face declarations:
the face applies (523.2px against a 580.7px serif fallback), the Latin weight
axis is live (400→700 widens 523.2→548.2), Hangul renders in Quiet Sans rather
than a system fallback (426.8px, against Malgun Gothic 475.2), and synthesised
Hangul bold still thickens — 1.57× the ink at 700.

Also in here

Two statements in SECURITY.md that the code did not support:

• it claimed one localStorage value; there are two, quiet-theme and
  quiet-cat-open
• it claimed heading ids are "derived rather than copied". They are derived only
  when the heading has none. An id written into a post by hand is used as it
  stands and reaches an href unescaped — author content on a single-author
  blog, so left as it is, but now written down accurately.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.