chore(voyage): release v4.3.0 — finalize version-sync + docs (3 re-review findings deferred to v4.3.1)

Bumps .claude-plugin/plugin.json 4.2.0 -> 4.3.0 (package.json, package-lock.json,
and the README badge were already at 4.3.0). Updates the v4.3.0 CHANGELOG entry with
the verified test count (711 pass / 0 fail / 2 skipped, 713 total), a "Re-review
remediation (Sesjon 13-18)" note covering the 11-finding cycle Waves 1-3 closed, and
a "Known issues — deferred to v4.3.1" subsection listing the 3 new findings the Sesjon
18 re-review surfaced in the remediation code (87069b35 SECURITY_INJECTION defense-in-
depth, 4cc3bfc9 PLAN_EXECUTE_DRIFT, c6c64a58 MISSING_TEST). Updates root CLAUDE.md
(voyage v4.0.0 -> v4.3.0, seven-command + playground), root README + plugin README
(test count, Known-limitations note, fixes the stale "trekplan@" install snippet ->
"voyage@"), root marketplace.json (voyage description), and plugin CLAUDE.md (Playground
paragraph). A plan-critic-reviewed Wave-4 remediation plan for the 3 deferred findings
is ready (.claude/plans/, gitignored).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

README.md

@@ -81,7 +81,7 @@ Key commands: `/config-audit posture`, `/config-audit feature-gap`, `/config-aud
 
 Deep requirements gathering, research, implementation planning, self-verifying execution, independent post-hoc review, operator-driven artifact annotation via voyage's marketplace playground, and zero-friction multi-session resumption — with specialized agent swarms, adversarial review, and failure recovery. Seven-command (brief, research, plan, execute, review, **revise**, continue) universal pipeline.
 
-v4.3.0 (non-breaking) rebuilds the v4.2 playground with a dashboard-centric layout, file://-loader, and matured anchor-rendering. `playground/voyage-playground.html` now opens a `.claude/projects/<slug>/`-mappe directly via `webkitdirectory` directory-picker, drag-drop with `webkitGetAsEntry` recursive walk, or `?project=/abs/path` URL-parameter — no more paste-into-textarea workflow. The new `fleet-grid` of `fleet-tile` per artifact with drill-down detail surface achieves visual parity with `plugins/llm-security/playground/llm-security-playground.html`. Anchor-rendering matures: block-boundary placement with code-fence/table/list-item fallback, browser-side `parseAnchor` mirroring Node-side regex, numbered-badge gutter + yellow-tint highlight, hidden-by-default sidebar-rail with J/K keyboard navigation, two-opacity pattern (active 100% / inactive 40% / resolved 30% strikethrough). A11Y panel built from DS-primitives. Screenshots-spor convention via `window.__voyage` hooks (`navigate` / `scheduleRender` / `getProjectArtifacts`) + `docs/screenshots/`. Path-traversal + symlink/dotfile filter (`isProjectPathSafe`). DOMPurify ≥ 3.1.1 vendored for `sanitizeAnnotation`; HTML-comment indirect prompt-injection mitigation via `parseAnchor`-allowlist gate before `md.render`. Total bundle 388 KB / 460 KB HALT-gate. Test pyramid Groups A-D — Group A 17 static-HTML grep tests (SC1 10-element checklist + SC3 + SC6 + SC7 tag-level no-CDN), Group B 9 structure tests, Group C 7 export-bundle schema + `annotation_digest` SHA-256 validity tests, Group D 4 Playwright e2e (light/dark axe-core delta-baseline + pixel-diff smoke + zero-external-network authoritative gate via `npm run test:e2e`). Test count: 672 → 705 pass / 0 fail. WCAG-violations baseline'd; actual fix deferred to v4.4 (HTML FROZEN in Sesjon 6 per Wave 7 verification-only scope).
+v4.3.0 (non-breaking) rebuilds the v4.2 playground with a dashboard-centric layout, file://-loader, and matured anchor-rendering. `playground/voyage-playground.html` now opens a `.claude/projects/<slug>/`-mappe directly via `webkitdirectory` directory-picker, drag-drop with `webkitGetAsEntry` recursive walk, or `?project=/abs/path` URL-parameter — no more paste-into-textarea workflow. The new `fleet-grid` of `fleet-tile` per artifact with drill-down detail surface achieves visual parity with `plugins/llm-security/playground/llm-security-playground.html`. Anchor-rendering matures: block-boundary placement with code-fence/table/list-item fallback, browser-side `parseAnchor` mirroring Node-side regex, numbered-badge gutter + yellow-tint highlight, hidden-by-default sidebar-rail with J/K keyboard navigation, two-opacity pattern (active 100% / inactive 40% / resolved 30% strikethrough). A11Y panel built from DS-primitives. Screenshots-spor convention via `window.__voyage` hooks (`navigate` / `scheduleRender` / `getProjectArtifacts`) + `docs/screenshots/`. Path-traversal + symlink/dotfile filter (`isProjectPathSafe`). DOMPurify ≥ 3.1.1 vendored for `sanitizeAnnotation`; HTML-comment indirect prompt-injection mitigation via `parseAnchor`-allowlist gate before `md.render`. Total bundle 388 KB / 460 KB HALT-gate. Test pyramid Groups A-D — Group A 17 static-HTML grep tests (SC1 10-element checklist + SC3 + SC6 + SC7 tag-level no-CDN), Group B 9 structure tests, Group C 7 export-bundle schema + `annotation_digest` SHA-256 validity tests, Group D 5 Playwright e2e specs (light/dark axe-core absolute zero-violation + pixel-diff smoke + inline-gallery + zero-external-network authoritative gate via `npm run test:e2e`). Test count: 672 → 711 pass / 0 fail / 2 skipped (713 total). A Sesjon 13–18 independent-review remediation cycle then closed all 11 review findings (DOMPurify on the artifact body, inline screenshots gallery, absolute-zero-violation a11y spec, Phase 9 `plan_critic` injection, fleet-grid CSS parity); a Sesjon 18 re-review found 3 new defense-in-depth/conformance findings in the remediation code itself — deferred to v4.3.1 (a ready, plan-critic-reviewed Wave-4 plan exists).
 
 v4.2.0 (non-breaking) adds the `/trekrevise` command and the **Handover 8 (annotation → revision)** annotation pipeline. The original `playground/voyage-playground.html` (single self-contained HTML with vendored `markdown-it` + `highlight.js`) lets operators paste a brief/plan/review, drag-select or hover-anchor comments, and export a `/trekrevise --apply` batch. Round-trippable in-place revision: byte-identical body outside anchor blocks (SC2), idempotent `annotation_digest` (SC3), additive frontmatter — no `*_version` bump, every brief / plan / review written before v4.2 validates as `revision: 0` without migration. Single-iteration MVP per research-05; multi-iteration loops deferred. Includes `lib/parsers/anchor-parser.mjs` + `lib/parsers/annotation-digest.mjs`, `lib/util/markdown-write.mjs` + `lib/util/revision-guard.mjs`, `scripts/render-artifact.mjs` server-side render CLI, and `docs/annotation-quickstart.md` ≤7-step operator walkthrough.