measure(rawhtml): the over-reach classes co-occur, so one-at-a-time understates both

Yesterday's correction fixed a wrong causal claim and published a second one.
It reported that narrowing the URL-attribute branch frees 3 documents in
reference-corpus and left the reader to conclude the over-reach is cheap.
Measured together with the `<base>` name-branch fix it frees 25, against a
ceiling of 26 — 96% of what the detector costs that population. A document
blocked by two over-reach classes is freed by neither alone.

The same pair frees 2 of a 38-document ceiling in vendor-harvest and 2 of 41
in generated-notes. The over-reach is nearly the whole raw-html cost in Azure
APIM policy XML and nearly none of it in vendor documentation.

Three further corrections:

- `<base />` appears in 25 reference-corpus documents, not 30. The published
  count came from `grep '<base'`, which also matched the literal
  `<base64_string>` placeholder — not a tag this detector fires on.
- Any fix moves TWO surfaces: `neutralize` imports `is_active_tag` by name, so
  narrowing it also stops the opt-in mutator defanging the same tags. No test
  covers that half; the suite's `neutralize:raw-html` payloads stay active
  under every narrowing considered.
- Adds `docs/rawhtml-census.py` so the ladder is reproducible instead of
  living in a session scratchpad. Corpus roots are arguments, never hardcoded.

Measured under the real edit, not reasoned: the suite fails exactly one test,
`test_raw_html_overblocks_are_still_high[relative-href-on-inactive-name]`,
which exists to force this doc update when an over-block closes. Recall holds
at 128/128 and all 6 documented gaps still hold.

docs/LIMITATIONS.md

@@ -233,18 +233,34 @@ items; this is the full list, each with the mechanism.
   `active:raw-html` in *52 of vendor-harvest's 98* to this over-reach. Measured by
   re-running the gate with the URL-attribute branch narrowed to *external* targets
   only, it frees **1 document in vendor-harvest, 1 in generated-notes, 3 in
-  reference-corpus** — the over-reach is real and it costs almost nothing, because
-  the documents carrying it almost always also carry a tag that is active by *name*,
-  and one raw-html finding per document is all it takes. What actually drives the
-  rate is the **name branch**: per wiki corpus `<a>` 298 occurrences, `<frame>` 94,
-  `<img>` 63; in reference-corpus `<base>` 113.
+  reference-corpus**, because the documents carrying it almost always also carry a
+  tag that is active by *name*, and one raw-html finding per document is all it
+  takes. What actually drives the rate is the **name branch**: per wiki corpus `<a>`
+  298 occurrences, `<frame>` 94, `<img>` 63; in reference-corpus `<base>` 113.
+  **Do not read "frees 3" as "this over-reach is cheap" — the over-reach classes
+  co-occur, and measuring them one at a time understates both.** In reference-corpus,
+  narrowing the URL-attribute branch alone frees 3 and taking `<base>` off the name
+  branch alone frees 13, but doing **both** frees **25** — because a document
+  carrying one class usually carries the other, so closing either alone leaves the
+  document blocked by its twin. Against a ceiling of 26 (raw-html detection switched
+  off entirely) the pair captures 96% of what this detector costs that population.
+  The same pair frees only 2 of a 38-document ceiling in vendor-harvest and 2 of 41
+  in generated-notes: the over-reach is nearly the whole raw-html cost in APIM policy
+  XML and nearly none of it in vendor documentation.
   **And the over-reach is not only MDX.** In reference-corpus it lands on Azure APIM
   policy XML — `<set-header>` 50, `<ip-filter>` 3, `<set-query-parameter>` 2 — which
   shares nothing with the `<Card href="/…">` shape beyond having a URL attribute.
+  **Any fix here moves two surfaces, not one:** `neutralize` imports `is_active_tag`
+  from this module, so narrowing it also stops the opt-in *mutator* from defanging
+  the same tags. No test covers that half — the suite's `neutralize:raw-html` cases
+  use payloads that stay active under every narrowing considered — so the mutator
+  would change behaviour silently. Whoever closes this writes that test first.
 - **`<base />` in Azure APIM policy XML grades HIGH on the name branch alone.**
   APIM's `<base />` means "run the inherited policy" and carries no attributes; it
   collides with HTML's `<base>`, whose entire affordance is its `href`. It appears in
-  **30 of reference-corpus's 389** documents. An attribute-less `<base>` has no
+  **25 of reference-corpus's 389** documents (`grep -rlE '<base\s*/?>'` — a loose
+  `grep '<base'` says 30 and is wrong: it also matches the literal `<base64_string>`
+  placeholder, which is not a tag this detector fires on). An attribute-less `<base>` has no
   affordance in any renderer, and a `<base href="…">` would still be caught by the
   URL-attribute branch — so the name-branch entry is doing no work here that the
   attribute branch does not already do. This is a distinct over-reach class from the