docs(cran): refresh cran-comments.md for the full v0.1.0 surface

[billdenney]

The Summary section had only mentioned the read surface plus the Tier 2 grab-bag (rendering, embedded images, Form XObjects, clip paths, document metadata). The actual v0.1.0 ships a complete mutation surface too: structural page edits, page-object styling

• geometry rebuild, page-object creation (paths, rects, text, JPEG images), annotation authoring (14 subtypes), form filling + flattening, attachment authoring, and font loading (14 standard fonts + arbitrary TrueType / Type1 embedding). Rewrite the Summary to call this out as the second half of the package.

Update the Expected NOTEs section to match what R CMD check --as-cran actually reports today: the Debian r-base default -mno-omit-leaf-frame-pointer compilation-flag NOTE is the only one currently observed; demote the previously-predicted "GNU make" and "Installed package size" NOTEs to "may appear" since they haven't materialised in the matrix.

Add a "readwrite opt-in" line to the CRAN policy checklist — this is the key safety net for accidental mutation and worth calling out for reviewers.

What changed

Why

Test coverage

• Added or updated tests for every behavioural change.
• R coverage remains 100% (verified locally with covr::package_coverage()).
• If touching src/, the change runs cleanly under AddressSanitizer (.github/workflows/cpp-asan.yaml) and valgrind (.github/workflows/valgrind.yaml).

API stability

• No exported symbol was renamed or removed without a deprecation cycle.
• If an exported function signature changed, an ADR was added or amended.

Decision records

• Linked an existing ADR if one applies.
• Added a new ADR if this PR locks in a material architectural choice.

Checklist

• pre-commit run --all-files passes locally.
• R CMD check --as-cran is clean (0 errors / 0 warnings).
• Documentation regenerated with devtools::document().
• NEWS.md updated under "(development version)".