feat(guard): active-content detector wired into the output gate (review MAJOR #1)

Close the EchoLeak wiring hole (CVE-2025-32711 class): markdown images/
links, reference definitions, autolinks, raw active HTML and data: URIs
now surface as report-only findings (active:*, OWASP LLM05) in
scan_output step 6, so screen_output and okf.import_bundle dispose of
them instead of admitting them with findings=[].

- new active_content.py: canonical home of the shared pattern table +
  scan_active_content; neutralize refactored to import it (mutating API
  and behavior unchanged, all neutralize tests pass as-is)
- images/links flagged only for absolute/protocol-relative URLs:
  relative in-bundle links are legitimate wiki/OKF mechanism (principle 5)
- evidence carries defanged URLs only (hxxps://evil[.]example)
- EchoLeak vectors planted in both showcases; detach proofs cover them
- README export list + checklist step 6, CLAUDE.md context line updated

Suite: 321 -> 341 passed. Core invariant intact (dependencies=[]).

README.md

@@ -64,8 +64,9 @@ and halts regardless of trust tier.
 
 Every primitive is also exported for pipelines that compose the checklist
 themselves — `sanitize`, `scan_lexicon`, `scan_entropy`, `scan_output`,
-`neutralize`, the `decide` / `guard` disposition machinery, and the contract
-asserters `assert_tool_less` / `assert_credential_allowlist` / `scoped_env`. See
+`scan_active_content`, `neutralize`, the `decide` / `guard` disposition
+machinery, and the contract asserters `assert_tool_less` /
+`assert_credential_allowlist` / `scoped_env`. See
 [the end-to-end showcase](tests/test_showcase.py) for a full worked pipeline.
 
 ## The reusable contract (adopt-this checklist)
@@ -82,8 +83,11 @@ The actual product is this checklist, encoded as code you wire in order:
    key; the publish stage holds only the publish credential; no stage holds both.
 5. **Treat output as data.** Parse to a frozen schema; reject on structural
    violation. The output never reaches a shell, git, or a filesystem path.
-6. **Scan output before persist.** Run the lexicon + entropy over the emitted
-   text. Verbatim-carried payloads and model-emitted instructions are caught here.
+6. **Scan output before persist.** Run the lexicon + entropy + active-content
+   scan over the emitted text. Verbatim-carried payloads, model-emitted
+   instructions, and zero-click exfil carriers (EchoLeak-class markdown
+   images/links, raw active HTML, `data:` URIs) are caught here; `neutralize`
+   additionally defangs them, opt-in.
 7. **Fail-secure on compound signals.** Injection hit + transform failure = halt
    + alert, never a silent verbatim commit.
 8. **Minimal alert payloads.** Alert with a gate code + run ID, never content.