[danoli3]

Update FreeType from 2.14.3 to 2.15.0 using the full upstream tag VER-2-15-0 and verified archive SHA-256 87c7f1f8699b91e89f773f7dcfa505b044e1dae67f62a55d4e29c3afdcac4fb8. Align GIT_TAG with the complete tag, update the version matrix and increment FreeType BUILD_ID from 1 to 4.

The copied CMakeLists was from 2.13.3 and omitted the new HVF driver: compilation succeeded, but consumers failed to link hvf_driver_class. Preserve the pinned release's CMakeLists so its source lists, generated configuration and package versions match. Disable the optional Apple HVF backend with FT_DISABLE_HVF=ON to avoid adding an undeclared HVF_* runtime dependency. Standard TrueType/OpenType support and existing zlib, PNG and Brotli/WOFF2 requirements remain enabled; HVF vector-font support is deliberately excluded.

Correct dependency discovery using the actual staged filenames:

• Android packages libpng as libpng.a.
• Emscripten packages it as libpng16.a. The old libpng.a path caused the ARCH=64 CI job to report PNG found and then fail generation with IMPORTED_LOCATION not set for imported target PNG::PNG.
• Pass Android's Brotli decoder/common libraries as a CMake list and correct the Apple zlib path.

A cold Linux Cairo build also downloaded pixman and built it without preparation, leaving its CMake overlay absent. Add that missing preparation call and increment Cairo BUILD_ID from 4 to 5.

Validation:

• Verified the exact FreeType source archive before extraction.
• Real macOS ARM64 apo update freetype, single-slice XCFramework staging, individual packaging and an extracted-package consumer passed. The consumer reports 2.15.0 and renders Arial's A at 18x17 pixels.
• Real apo update freetype builds passed for both existing Emscripten variants, ARCH=32 and ARCH=64, using the same Emscripten 6.0.11 SDK as CI. Ran the real individual packager, extracted its output, and linked and executed Node consumers for both variants; both report 2.15.0 and render Arial's A at 18x17. Generated configurations retain PNG, system zlib and Brotli support.
• The focused real-source CMake 3.31 FindPNG reproduction and cold Cairo preparation-order check pass. Formula checksum audit covers 42/42 networked scripts; macOS Bash 3.2 syntax and diff checks pass.

Full multi-platform CI and publication remain pending. The local font consumers cover TrueType rendering, not WOFF2 runtime decoding. Local Android NDK verification remains blocked by pre-existing macOS host-directory detection in the shared Android toolchain.

Rebased onto bleeding e1b06a40, preserving the merged Curl, FreeImage and build-profile updates. Refs #612.