[krflol]

npm 0.5.0 prints script source and other hidden descendants in several HTML contexts. It also uses automatic decoration thickness when from-font should select the face's metric. Pin the unmodified published Fullbleed 2.5.24 crate and prepare package 0.5.1 with both fixes for Node and browser users.

Preserve explicit author display overrides and existing API defaults. Embedded stylesheets remain ignored; CSS is supplied through the API. The reviewed invoice/report output hashes are unchanged.

Verification:

• Local locked WASI build, Node tests, ESM/CommonJS/browser type checks, isolated tarball installation, independent output checks, and 257 native/WASI comparisons pass. All 24 Python checks pass, including 18 publication-gate tests.
• All 13 CI jobs pass: nine OS/Node combinations plus Chrome, Firefox, and WebKit. Each browser completes 816 checks and downloads 537 PDF/PNG files from the exact CI tarball.
• 94 hidden-text source/control pairs pass in both Node isolation modes, with independent text and pixel checks. Published npm 0.5.0 reproduces 77 affected pairs per mode while preserving every control.
• 37 engine fixtures pass in both modes, including 24 decoration fixtures measured against the font's metrics and emitted strokes. The old package retains eight affected decoration cases and 40 passing controls.
• Actual CI Chrome downloads were visually inspected and match the local positive previews exactly. The interruption stopped the local Chrome attempt before its final receipt; its partial output is retained, and the completed CI browser runs supply the publication evidence.

The release assembler binds all retained results to the source commit, fixture hashes, and tarball bytes before trusted npm publishing. These finite checks do not establish general CSS parity, PDF standards conformance, or resolution of #7.

Fixes #34.