… are added locally, they aren't in the old reference OTF so they get committed with raw FontForge bytecode (containing callsubr

tokens). On the next CI rebuild those glyphs are in the reference, so the freeze loop inlines their subr calls — producing different bytes from what's committed.

The fix adds a second pass after the freeze loop that desubroutinizes all charstrings using the new font's own subr table. New glyphs are normalised on the same local build they're added, so what gets
committed is already stable. CI sees inlined charstrings in the reference, _inline_subrs is a no-op, and the bytes are identical.