fix(active-content): raw-html graded two inert shapes HIGH, and the fix moved a second surface

`is_active_tag`'s URL-attribute branch was a presence test: any element carrying
`href=`/`src=`/`action=` graded HIGH regardless of where the URL pointed. An MDX
`<Card href="/en/agent-sdk/quickstart">` reaches no attacker-controlled host, and
neither does APIM policy XML's `<set-header>`. It now requires an external target
-- the rule the markdown paths have applied since 0.3.1. `<base>` left the active
name set in the same change: HTML's `<base>` has its whole affordance in an `href`
the attribute branch still catches, and APIM's attribute-less `<base />` is inert.

Measured before and after in ONE session against one corpus state, because two of
the three corpora are living and a split would mix this with re-harvest drift:

  reference-corpus  389 docs   133 -> 108   (ceiling 107)
  vendor-harvest    187 docs   100 ->  98   (ceiling  62)
  generated-notes   550 docs    90 ->  88   (ceiling  49)

96% of the achievable reduction in reference-corpus, 5% in the wiki corpora. The
two classes had to be measured TOGETHER -- alone they free 3 and 13 documents,
together 25, because a document carrying one usually carries the other.

The second surface: `neutralize` imported `is_active_tag` by name, so this would
have silently narrowed the opt-in mutator too -- and no test discriminated the two
halves, since every `neutralize:raw-html` payload stays active under any narrowing
considered. That test is written first here. The predicates are now separate
symbols; the mutator keeps defanging anything, because over-defanging is auditable
and blocks nothing while under-defanging hands a human a live construct.

Behaviour change: a document whose only finding was one of these classes now WARNs
instead of holding. Detection is unchanged -- 128/128 classes, 6/6 gaps hold.

Self-safety: reading an attribute VALUE needs a pattern the presence test lacks. It
reuses the same literal alternation so no new run shape enters the table; its
`_REDOS_PAYLOADS` row denies the `=` the pattern requires, since a unit supplying it
matches at once and never exercises the run (the lexicon's `script-tag` row is the
cautionary case). 0.031-0.046s across five attack shapes at 100_000 chars against a
2.0s bound; `docs/redos-sweep.py` reports 0 candidates of 152. An attribute the
presence test saw but the value parser cannot read counts as external -- fail secure.

`docs/rawhtml-census.py` gains a PRODUCTION row that re-measures the shipped
predicate rather than a hypothesis, so a published number and the code cannot drift
apart unnoticed. README's limitation count moves 34 -> 33.

727 passed (was 717).

docs/rawhtml-census.py

@@ -22,10 +22,15 @@ TWO METHOD TRAPS IT EXISTS TO AVOID:
   effect with corpus drift. Every candidate here runs against the same corpus state
   in one process, and `base` is re-measured rather than quoted from the doc.
 
-The candidates are applied by replacing `active_content.is_active_tag` in-process.
-That mirrors a real edit for the *scanner* path only: `neutralize` imports the
-symbol by name, so a real edit would also change the mutator, which this script does
-not simulate. See the raw-HTML bullets in `docs/LIMITATIONS.md`.
+The candidates are applied by replacing `active_content.is_active_tag` in-process,
+which mirrors a real edit to the *scanner*. Since 0.6.0 that is the whole story:
+`neutralize` calls its own `is_defangable_tag`, so patching this symbol cannot
+move the mutator. Before 0.6.0 the two shared one symbol and this caveat read the
+other way. See the raw-HTML bullets in `docs/LIMITATIONS.md`.
+
+The `PRODUCTION` row is the only one that is not a hypothetical: it leaves the
+shipped predicate in place. A shipped narrowing must equal its candidate row, and
+saying so in the output is what keeps the doc's numbers checkable after the fact.
 
 USAGE — corpus roots are arguments, never hardcoded; the corpora live in private
 consumer repos and their paths must not reach a public mirror:
@@ -88,7 +93,7 @@ def _variant(*, drop: frozenset[str] = frozenset(), external_only: bool = False)
 
 
 CANDIDATES = [
-    ("base", _variant()),
+    ("pre-0.6.0 (no narrowing)", _variant()),
     # The URL-attribute branch requires an EXTERNAL target — the rule the markdown
     # paths already apply. A relative `href` reaches no attacker-controlled host.
     ("A: url-attr external-only", _variant(external_only=True)),
@@ -98,6 +103,10 @@ CANDIDATES = [
     ("base-url: <base> needs a URL", _variant(drop=frozenset({"base"}))),
     ("A + base-url (both)",
      _variant(drop=frozenset({"base"}), external_only=True)),
+    # Not a hypothetical: the shipped predicate, unpatched. `A + base-url` is what
+    # 0.6.0 shipped, so these two rows must agree — a mismatch means the code and
+    # this script have drifted apart and every number below is suspect.
+    ("PRODUCTION (as shipped)", None),
     # The CEILING: no narrowing can free more than switching the detector off.
     ("NONE (ceiling)", lambda name, attrs: False),
 ]
@@ -180,7 +189,7 @@ def main() -> None:
 
             baseline = None
             for name, fn in CANDIDATES:
-                ac.is_active_tag = fn
+                ac.is_active_tag = original if fn is None else fn
                 non_warn = sum(
                     1 for t in texts
                     if screen_output(t, PRESET_USER_UPLOAD).disposition is not BENIGN