EffectCraft: all versions and old releases

What's Changed
- svg: bound raster surfaces and handle duplicate gradient stops by @dylanmtaylor in https://github.com/storytold/effectcraft/pull/2190
- ui: bound queued synthetic input gestures by @dylanmtaylor in https://github.com/storytold/effectcraft/pull/2197
- text: bound layout and variable font metadata by @dylanmtaylor in https://github.com/storytold/effectcraft/pull/2193
- pdf: bound image sample and mask allocations by @dylanmtaylor in https://github.com/storytold/effectcraft/pull/2191
- roto: bound frozen matte decoding and serialization by @dylanmtaylor in https://github.com/storytold/effectcraft/pull/2194
- expr: bound rewrite expansion and preserve assignment targets by @dylanmtaylor in https://github.com/storytold/effectcraft/pull/2195
- fix: validate the CLI path in the AE ease checker (SonarCloud jssecurity:S8705) by @dylanmtaylor in https://github.com/storytold/effectcraft/pull/2214
- fix: put the NOSONAR marker on the spawnSync line (SonarCloud follow-up) by @dylanmtaylor in https://github.com/storytold/effectcraft/pull/2215
- fix: document the AE checker's operator-supplied CLI path (SonarCloud) by @dylanmtaylor in https://github.com/storytold/effectcraft/pull/2217
- fix: suppress the stat check's taint finding (SonarCloud) by @dylanmtaylor in https://github.com/storytold/effectcraft/pull/2218
- segment: bound checkpoint tensors and pickle work by @dylanmtaylor in https://github.com/storytold/effectcraft/pull/2192
- xtask: use unique temporary directories for bench tests by @dylanmtaylor in https://github.com/storytold/effectcraft/pull/2196
- packaging: use [[ tests, named locals and explicit returns (SonarCloud S7688/S7679/S7682) by @dylanmtaylor in https://github.com/storytold/effectcraft/pull/2187
- Use chrono instead of hand-rolled UTC conversion by @dylanmtaylor in https://github.com/storytold/effectcraft/pull/2023
- CI: dev-profile gate, one test binary per crate, nextest, line tables only by @aiongg in https://github.com/storytold/effectcraft/pull/2235
- Packaging: pin the signing client and appimagetool, and check their hashes by @aiongg in https://github.com/storytold/effectcraft/pull/1976
- Footage, Lottie and models: resolve stored paths with craft-docpath's resolve_absolute by @aiongg in https://github.com/storytold/effectcraft/pull/1975
- GPU tests: pass on Mesa lavapipe (boundary flips, skip the Reshape case that crashes it); cargo fmt by @aiongg in https://github.com/storytold/effectcraft/pull/2239
- CI: shared gate workflow; FreeBSD nightly and on release by @aiongg in https://github.com/storytold/effectcraft/pull/2204
- security: move the release workflow's write permission to the job level (SonarCloud githubactions:S8233) by @dylanmtaylor in https://github.com/storytold/effectcraft/pull/2241
- Translations: missing strings show in English and are listed by a report, not failed by tests by @aiongg in https://github.com/storytold/effectcraft/pull/2244
- ci(sonar): stop cancelling main-branch runs so coverage is published by @dylanmtaylor in https://github.com/storytold/effectcraft/pull/2249
- Integration batch 1: 18 contributor PRs (CJK fonts, timeline, preview caches, interface languages) by @aiongg in https://github.com/storytold/effectcraft/pull/2257
- Preview: keep rendering past the cached frames after a loop or restart by @ded-achtung in https://github.com/storytold/effectcraft/pull/1920
- Layer: replace a layer's source with Alt-drag and Ctrl+Alt+/ (#991) by @ki2pixel in https://github.com/storytold/effectcraft/pull/1929
- Layer: Reveal Layer Source in Project from the context menus (#1809) by @ki2pixel in https://github.com/storytold/effectcraft/pull/1931
- Timeline: the disk-cache bar checks only the visible frames by @arnav-hiwarkar in https://github.com/storytold/effectcraft/pull/2048
- engine: split layers above the original by default (#2083) by @gmrmad1 in https://github.com/storytold/effectcraft/pull/2114
- ui: Spacebar hand pans timeline rows vertically (#2083) by @gmrmad1 

Note
FreeBSD aarch64 is dropped from this release. We had to cut releases, and we cannot build this target within the 5-hour CI limit for any of the Craft apps, so we are dropping it for now. This is a known blocker, flagged for a future fix in storytold/craft-common-actions#39. FreeBSD x86_64 and every other platform are included.
What's Changed
- security: use crypto.randomUUID for temp file suffix (SonarCloud S2245) by @dylanmtaylor in https://github.com/storytold/effectcraft/pull/2061
- fix: JS reliability bugs (SonarCloud S1764/S9383/S4275) by @dylanmtaylor in https://github.com/storytold/effectcraft/pull/2062
Full Changelog: https://github.com/storytold/effectcraft/compare/v0.15.0...v0.16.0