Version 0.59.3

Locked down, with tests, that a previewed file from someone else is never rendered as a live document.

A preview shows HTML and SVG as source and opens a PDF inside a frame that cannot run scripts. The half that decides how to show a file was covered by tests; the half that draws it was not, and only a comment held the rule. That half now lives on its own and is fed three deliberately hostile files in a real browser, and a repo-wide check refuses a frame without isolation. Nothing on screen behaves differently — what this release protects is the next person to change this code.