[snowyukitty]

Fixes #201.

Subsetting a transformed WOFF2 TrueType font currently copies transformed glyf bytes as ordinary TrueType records. The regression cases demonstrate incorrect outlines and buffer bounds errors.

Reconstruct glyph records from decoded points, contour ends, instructions and component records, remapping component IDs and writing long loca offsets. Preserve point indices used by hint programs, composite transforms and overlap flags. Native regressions cover repeated encoding, empty glyphs and variation metrics with a reproducible, original test font. A generated contourless composite also checks that stored nonzero bounds and its bearing survive the upstream empty-path box change.

The latest merge preserves upstream #426's ordinary TrueType variation handling (including composite flattening and varied bearings), #427's HVAR rounding and #415's layout fixes. Transformed WOFF2 uses its separate reconstruction path, retaining component records and hint point indices.

Transformed hmtx remains unsupported and produces an explicit error. Non-default variation subsets can differ from a reference instancer in coordinates, bounding boxes, advance/bearing metrics and component offsets; cvar adjustments are not instantiated. This does not add a general variable-font instancer.

Validation on Linux after merging master 2dee1a31b6673847d1cc8fd702e98ba2cbd51f81:

• npm run prepublish, npm run format:check and npm test: 718 passing, 7 pending on Node 22.23.1, 24.18.0 and 26.12.1.
• With unchanged current-upstream production code and these regression tests, npm run mocha -- test/subset.js gives 12 intended failures, 16 passing controls and 1 pending test. The upstream ordinary-TrueType variation regressions pass in this comparison and on the merged candidate.
• Independent FontTools comparison: all 1,980 default-instance glyphs in Source Sans Pro and the original test font retain points, contour ends, flags, instructions, component transforms, bounds and metrics. All 100 FreeType raster comparisons at 12/48 px, with and without hinting, are identical. Additional non-default comparisons retain the limitations described above.

Both sets of changelog entries are preserved. No dependencies change.