feat(output): report hidden markup — tiny font, invisible colour, comments outside code

Session 5 of the 2026 threat plan (attack row 3): A04 and A15 were red.

- html-obfuscation:tiny-font (HIGH): font below 4px. ShadowLeak's 1px passed
  because the commons zero-font row only matches a leading 0.
- html-obfuscation:invisible-colour (HIGH): text within 8 per channel of the
  background in the same style attribute, or transparent. White alone is not
  a signal (email buttons); measured residual in LIMITATIONS.
- output:html-comment-present (MEDIUM): a comment in the artifact outside
  fenced code and inline code. 253/254 comments in the reference corpus sit
  in code.

Local to output.py; the vendored lexicon stays byte-equal with commons.
Guard rule before/after: FP 106/198, 196/2918, 108/389 identical; OKF 6/53
and 47/31 identical. Matrix 139/139, ReDoS 161 patterns 0 flagged, suite
1142 passed + 6 xfailed. Row 3: 12 caught, 1 gap, 6 open.

tests/test_docs_measurement_scripts.py

@@ -272,13 +272,13 @@ def test_redos_sweep_floor_and_flag_match_the_published_numbers():
     assert "2.6 flag threshold" in text
 
 
-def test_redos_sweep_collector_covers_154_patterns_across_11_tables():
-    # The count docs/LIMITATIONS.md carries as "all 154 compiled patterns across
+def test_redos_sweep_collector_covers_161_patterns_across_11_tables():
+    # The count docs/LIMITATIONS.md carries as "all 161 compiled patterns across
     # all eleven regex-bearing modules". A pattern added or removed in `src/`
     # without re-measuring would drift the doc's claim silently otherwise.
     assert len(redos_sweep.TABLES) == 11
     total = sum(len(collect()) for collect in redos_sweep.TABLES.values())
-    assert total == 154
+    assert total == 161
 
 
 # --- both scripts: the argument-less contract --------------------------------