release v0.2.1 — entity passthrough, SSRF hardening, background positioning

[ajianaz]

Context

Three significant changes are merged to develop after v0.2.0 was tagged, so the published v0.2.0 binaries lack them:

• fix(render): preserve pre-existing XML entities in text values #77 — XML entity passthrough (v0.2.0 binaries crash on & < > in data and double-escape pre-existing entities)
• feat(render): image URL fetch + SSRF hardening #81 — SSRF hardening for remote image fetches (private-address guard, DNS pinning, streaming size cap, https-only default, --allow-private-images / --allow-local-image-paths flags, spawn_blocking on the server render path)
• feat(render): user-positioned background images (zoom + focal point) #82 — user-positioned background images (bg_image_scale / bg_image_x / bg_image_y) + intrinsic-dimension reporting

Tasks (release flow option A)

• Branch chore/release-v0.2.1 from develop
• Pre-merge origin/main into the release branch
• CHANGELOG v0.2.1 section (Fixed: entity double-escaping; Security: SSRF hardening + local-path gating; Added: bg positioning fields)
• PR release branch → main, squash, tag v0.2.1 on main → multi-platform binary release workflow
• Verify published binaries: render with & < > + entities; cosy serve rejects local-path and private-URL image fetches by default

Notes

• Cora Review timeout on security-sized diffs: handled via PR splitting; no workflow change needed