fix(sanitize,okf,active_content): three quadratic patterns, two on the input path

The generalised sweep found what 0.3.2's hand-written rows missed. All three are
the documented class -- a run in front of a required literal that never arrives,
so every start position rescans the tail -- and all three are worse than the
0.3.3 findings, because `sanitize`, `neutralize`, `scan_active_content` and the
okf link graph apply NO input cap. `scan_lexicon`/`scan_output` are the only
entry points that do, so there is no ceiling to extrapolate to.

  sanitize._HTML_COMMENT_RE   `<!--`*100_000        20.1s, exponent 1.96-2.14
  active_content.URL_IN_TEXT_RE  `<a `+`A`*100_000  12.99s / 14.9s, exponent ~2.0
  okf._MD_LINK_RE             `[`*100_000            7.1s, exponent 1.99-2.05

Each fix is the one the pattern's own shape allows, not a copied choice:

  - The comment stripper drops the regex for `str.find`. Excluding `<` would lose
    every comment containing markup; bounding the run would be a carrier bypass
    of the exact construct the stripper exists to remove.
  - `URL_IN_TEXT_RE` bounds its scheme run to an RFC 3986 scheme (`{0,63}`).
    Bounding is safe *here* only because it is a defanger inside a tag already
    flagged `active:raw-html`. A lookbehind was measured too and rejected: it
    drops `-http://evil.com`, a one-character evasion. Bounded: 0.185s at 1M.
  - `_MD_LINK_RE` excludes `[`, matching `active_content.MD_LINK_RE` exactly,
    including the nested-label trade already documented there.

`sanitize` claimed "no catastrophic backtracking" in a comment; that claim was
wrong in the same way `output`'s was before 0.3.2, and is corrected in place.

676 tests (+10), coverage 128/128 + 6/6 gaps, sweep clean across 150 patterns.
The okf destination run gets no row: `[^)\s]+` cannot fail, so a row for it
could never go red.

tests/test_active_content.py

@@ -18,6 +18,8 @@ from __future__ import annotations
 
 import pytest
 
+import time
+
 from llm_ingestion_guard import (
     scan_active_content,
     scan_output,
@@ -294,3 +296,38 @@ def test_raw_html_counts_end_tags():
             if f.label == "active:raw-html"]
     assert len(pair) == 1, "a start/end pair must not split into two findings"
     assert pair[0].count == 2, f"end tag not counted: {pair[0].count}"
+
+
+# --- self-safety (OWASP LLM10): the long-attribute arm -----------------------
+# The `_REDOS_PAYLOADS` rows in test_output.py attack tags that never CLOSE, so
+# `HTML_TAG_RE` fails and the tag body is never handed on. This arm is the
+# opposite: the tag closes, and its body is long. `_tag` then runs
+# `URL_IN_TEXT_RE` over it, whose scheme run sits in front of a required `://`
+# that never arrives — 12.99s at 100_000 chars through this scanner, exponent
+# 1.87-2.06 over four doublings, with no input cap on this entry point at all.
+# Missed by the 0.3.2 sweep because a repeating-unit payload cannot express
+# "one tag, long body"; found by docs/redos-sweep.py generalised past lexicon.
+_ATTR_REDOS_N = 100_000
+
+
+def test_crafted_long_attribute_tag_stays_bounded():
+    payload = "<a " + "A" * _ATTR_REDOS_N + ">"
+    start = time.monotonic()
+    scan_active_content(payload)
+    assert time.monotonic() - start < 2.0
+
+
+def test_url_defanging_survives_the_redos_fix():
+    # Recall parity for the evidence defanger, including the two forms a
+    # lookbehind-based fix would have dropped (`-` / `.` immediately before the
+    # scheme), which is why the scheme run is bounded instead.
+    for raw, expected in (
+        ("<a href=http://evil.com>", "hxxp"),
+        ("<a href=-http://evil.com>", "hxxp"),
+        ("<a href=.http://x.com>", "hxxp"),
+        ('<a href="https://a.b/c">', "hxxps"),
+    ):
+        report = scan_active_content(raw)
+        evidence = " ".join(f.evidence or "" for f in report.findings)
+        assert expected in evidence, raw
+        assert "http://" not in evidence and "https://" not in evidence, raw