fix(render): clip outset box shadows

[lisa0314]

What changed

• remove the original rounded border box from every outset shadow layer
• render each shadow in a bounded temporary surface before applying ancestor clips
• preserve transparent interiors while keeping blur, offset, spread, rounded corners, and opaque backgrounds intact
• add renderer pixel coverage, a CLI PNG regression, and a deterministic render fixture

Validation

• cargo nextest run --release --features paint -p obscura-render --no-fail-fast: 580 passed, 1 skipped
• cargo nextest run --release --features render -p obscura-cli --test box_shadow_screenshot: 1 passed
• cargo nextest run --release --features render --no-fail-fast: 1408 passed, 4 skipped
• cargo build --release -p obscura-cli --bins --no-default-features
• cargo build --release -p obscura-cli --bins --features render
• git diff --check

Rendering

• pixel coverage verifies transparent and opaque centers, crisp offset gaps, outside ink, rounded corners, and the reported blurred-shadow case
• the CLI PNG regression decodes the screenshot and asserts the transparent interior, offset gap, outside shadow ink, and opaque control pixels
• render-repros/box-shadow-outset.html produced a nonblank image with the expected transparent interiors
• a live quotes.toscrape.com capture kept quote interiors readable and shadows outside their boxes
• a paired Chromium corpus was not available in the local environment, so no Chromium parity claim is made

Performance

Each shadow uses a temporary surface bounded by its visible ink rather than a full-viewport mask. Five same-fixture CLI captures showed no visible latency regression. Excluding the first process startup, the baseline median was about 22.2 ms and the candidate median was about 20.4 ms. This is treated only as a regression check, not as a speedup claim.

Checklist

• The change is focused on outset box-shadow compositing.
• Renderer and public CLI regressions cover the reported failure.
• Full render tests and render and no-render release builds passed.
• Deterministic and live rendering evidence was inspected.
• Performance-sensitive allocations remain bounded to visible shadow ink.

Fixes #641.