Fix duplicate bold PDF text and prepare 2.5.6

[krflol]

Problem and change

The Node quickstart's Invoice INV-1042 heading looked correct, but four independent readers extracted it twice (PDFium interleaved letters). Upright synthesized bold emitted visible Type 3 text plus an invisible logical text copy. Paint the visible glyphs with reusable vector forms so only the authored logical text is searchable.

Keep affine transforms on native path-form previews so glyph strokes scale with their outlines, and resolve font resources when text uses them so an unused restored Helvetica selection does not reject transformed PDF/UA-profile output. Add actual-PDF extraction and visual coverage gates to CI and release workflows, including compiled fixed/reflow/compact repeat checks. The core gains no runtime dependency.

Prepare synchronized 2.5.6 metadata and regenerate agent artifacts from the built and installed final wheel. Refresh the reviewed Acme invoice PDF/golden hash; all existing direct PNG golden hashes remain unchanged. Mark PDF files as binary to preserve their stream bytes.

Validation

• 1,306 default Rust tests; 1,307 Rust tests with Python/SVG features.
• 497 Python tests against the built and installed 2.5.6 wheel.
• 36 styled PDFs across ordinary, tagged, and PDF/UA-1-profile options extract the authored text once in pypdf, PyMuPDF, pdfminer.six, and PDFium. These are fixture checks, not profile certification or screen-reader acceptance.
• Native preview coverage rejects a deliberately retained intermediate oversized-stroke regression. Inspected all styled preview fixtures.
• Matching-input before/after PDFs differ by at most 0.0024% in total rendered ink in the retained independent-renderer comparisons. All compared earlier-version native previews remain byte-identical.
• Acme invoice independent rendering changes only nine color channels (maximum delta 15); its direct PNG golden stays byte-identical. All three golden documents pass.
• Installed-package smoke, generated contracts, release metadata, license integrity, CSS status, bundled Skill publishing dry run, and wheel/sdist builds pass.

Retained local reader versions, source hashes, PDF hashes, and comparison results: docs/release/2.5.6-validation.json. CI retains styled PDFs and previews. Linux/Windows, print-profile, and platform release gates remain required before publication; the dedicated PDF/VT validator is unconfigured.

CI run 37135540397 passed all 11 configured checks; the optional dedicated PDF/VT check was skipped. Downloaded Linux and Windows styled-document artifacts both pass with pypdf 6.19.0, and all 36 PDF and native-preview hashes match across the two platforms.