Release 0.28.0

[danmolitor]

Prepares 0.28.0 up to publish: version bump, changelog, docs, SDK WASM, and the full pre-publish gate. Nothing is published.

What ships

Everything merged since 0.27.0: #183, #184, #185 and #187. Content-sized text boxes hold the shaped line they are sized for (no more mid-word splits from kerning), text with a hard break measures as its widest line, justified text is justified in registered fonts too, justified styled runs no longer overlap, a line ending with a forced break is left unjustified, and Korean documents serialize in milliseconds. Issues #181, #182 and #186 are addressed; they are to be closed once this is published. The root CHANGELOG.md entry lists the behaviour changes and corrects the 0.26.0 note on justified registered-font text.

In this PR

• All packages bumped to 0.28.0 (scripts/bump-version.sh): every @formepdf/* npm package, forme-pdf and forme-pdf-html crates, formepdf (PyPI); lockfile regenerated (only our 19 workspace versions moved)
• Python SDK WASM rebuilt; both SDK copies verified by hash (scripts/verify-sdk-wasm.sh, engine source 2dc66a1e18ef). The forme-go copy is committed in that repo, unpushed until the tag step
• CHANGELOG.md 0.28.0 entry and the docs/changelog.mdx highlight

Pre-publish gate (all green on a9460a3)

• Builds: engine, html, every npm package in dependency order, svelte check; fmt and clippy clean in both crates
• Copied artifacts: both SDK WASMs match the engine; the VS Code bundle's core and HTML WASMs match their sources; the renderer preview HTML matches
• Tests: engine 676, visual regression 9, HTML 276; every package suite; core template snapshots; native vs WASM byte parity on every HTML fixture; forme-go go test; docs gallery current; veraPDF PDF/UA-1 and every PDF/A level, and the e-invoice gate. Byte wall against v0.27.0 identical
• Real-template corpus (15 templates): warnings and page counts unchanged. Two Crater invoices change by 1 and 4 bytes, from Measure intrinsic text width the way the line breaker does #184's table-column fix (a <span>/<br>/<span> cell now measures as its wider line), checked against Chrome; dispositioned and re-baselined
• Supply chain: lockfiles (forme, packages/react, forme-landing, pdf-testkit) checked against the March axios compromise (axios@1.14.1, axios@0.30.4, plain-crypto-js), @subql/common@5.8.3 (October 5), and the 0.27.0 lists (Shai-Hulud "ChainDrop", the September 21 and 27 malicious-package lists, node-ipc); none present. The MALFEX campaign's package names are not yet published

After merge (manual)

1. Publish in RELEASE.md order (npm, VS Code, PyPI, crates.io)
2. Tag the monorepo v0.28.0 on the merged commit (push main first), and create the GitHub release from the changelog
3. forme-go: push main, tag v0.28.0
4. Downstream: pdf-testkit, forme-landing, docs
5. Close Text runs can be measured narrower than their shaped line width, forcing mid-word breaks in flex rows #181, Font subsetting is O(glyphs × 65,536), Korean(CJK) documents take seconds to serialize! #182 and textAlign: justify — ignored with registered TTF fonts; mixed runs overlap; lines ending with a forced break are stretched (0.27.0) #186