feat(guard): active-content detector wired into the output gate (review MAJOR #1)

Close the EchoLeak wiring hole (CVE-2025-32711 class): markdown images/
links, reference definitions, autolinks, raw active HTML and data: URIs
now surface as report-only findings (active:*, OWASP LLM05) in
scan_output step 6, so screen_output and okf.import_bundle dispose of
them instead of admitting them with findings=[].

- new active_content.py: canonical home of the shared pattern table +
  scan_active_content; neutralize refactored to import it (mutating API
  and behavior unchanged, all neutralize tests pass as-is)
- images/links flagged only for absolute/protocol-relative URLs:
  relative in-bundle links are legitimate wiki/OKF mechanism (principle 5)
- evidence carries defanged URLs only (hxxps://evil[.]example)
- EchoLeak vectors planted in both showcases; detach proofs cover them
- README export list + checklist step 6, CLAUDE.md context line updated

Suite: 321 -> 341 passed. Core invariant intact (dependencies=[]).

src/llm_ingestion_guard/__init__.py

@@ -32,6 +32,7 @@ from .entropy import scan_entropy, EntropyResult, DecodedBlob
 from .lexicon import scan_lexicon, load_lexicon, LexiconPattern
 from .fence import fence, FenceResult
 from .neutralize import neutralize, NeutralizeResult
+from .active_content import scan_active_content
 from .output import scan_output, scan_secret_egress
 from .disposition import (
     decide,
@@ -131,7 +132,7 @@ __all__ = [
     "fence", "FenceResult",
     "neutralize", "NeutralizeResult",
     # output-side
-    "scan_output", "scan_secret_egress",
+    "scan_output", "scan_secret_egress", "scan_active_content",
     # disposition
     "decide", "guard", "Policy", "Trust", "Provenance",
     "Disposition", "DispositionResult",