Repair five regressions found in the open PR review

[airmang]

The open-PR review found five reproducible regressions that need follow-up before merging the affected branches:

• feat(table): split a cell into rows and columns as Hancom does #432/feat(table): insert and delete rows and columns and split cells on the table object #433: a row-only cell split accepts a covered or out-of-range column and edits another cell or reports a no-op success.
• feat(table): insert columns by cloning a grid column #430–feat(table): insert and delete rows and columns and split cells on the table object #433: nonblank row/column cloning duplicates native object identities. Cloning content whose identities cannot be remapped safely should fail closed; blank insertion should remain available.
• fix(shapes): refuse sizes and corner ratios Hancom reads as 0 #416 and dependent PRs: picture HWPUNIT sizes are coerced with int() before validation, accepting bools and fractional values that other shapes reject.
• build(deps): Bump the github-actions group with 2 updates #397: the release workflow changes its pinned action SHA without updating the fail-closed safety test's exact expectation.
• fix(page): write a column definition ahead of its paragraph's text #420/fix(layout): follow columns that change inside a section #421: a section-settings run containing text leaves the new column definition behind that text.

The fixes will include regression tests for refusal without mutation, preserve the existing Hancom-saved fixture checks, and propagate into the affected stacked PRs. First-paragraph live Hancom rendering is not claimed by these structural checks.

Repair status

The fixes have been pushed to #397, #416–#421, #428 and #430–#433 without rewriting branch history. Each dependent PR contains the same repair commits.

• Row-only splits now require an exact anchor and preserve the document on refusal.
• Native-object, field, bookmark and linked-reference content cloning fails closed; blank insertion keeps the original objects. XML quoting/spacing variants cannot bypass the guard. Native identity remapping remains unsupported.
• Picture HWPUNIT values are validated before coercion and before storing images or runs.
• Release action-pin expectations match the updated workflow, with all 56 safety tests passing locally.
• First-paragraph column definitions precede text while preserving the run formatting, including after save/reopen. Live Hancom rendering of this case is still unverified.

Targeted regression tests, static/type checks, and a clean installed-wheel smoke test pass. The legacy public-form row test now separates text-row cloning from logo-row refusal, with an explicit unchanged-document assertion. The final combined integration suite passes: 6,541 passed, 19 skipped, 1 known xfail, with 89.87% coverage (80% required). Current GitHub CI is still running/queued; no final remote-CI success or merge is claimed.