feat(active): report a run of images whose order carries a value

Session 6 of the 2026 threat plan (attack row 3): A05 output was red.
CamoLeak renders a secret as one image per character from a URL alphabet;
each URL is ordinary, so each image graded LOW and the gate WARNed.

- active:markdown-image-sequence (MEDIUM): at least 4 ordinary external
  images, inline or reference-style, on one URL template whose varying
  tokens are 2 chars or fewer, or digit runs. Digits that count up in
  document order are a counter and carry nothing. The per-image grade is
  unchanged; the finding sits beside it.
- Accepted twins (flag tables, figures 1a/1b) go to review; measured
  evasions (word dictionary, 3-char symbols, counter increments, run of 3,
  a template per symbol) are in LIMITATIONS.

Guard rule before/after: FP 106/198, 196/2918, 108/389 identical. Those
corpora hold no external markdown image, so the rule was also run on 577
package READMEs (312 with external images): 0 firings at run lengths 3-8.
OKF import 47/31 identical. Matrix 140/140, ReDoS 163 patterns 0 flagged,
suite 1179 passed + 5 xfailed. Row 3: 13 caught, 1 gap, 5 open.

tests/test_attacks_2026.py

@@ -225,8 +225,8 @@ GAP_CASES = [
 # A01 and A02 caught from 1.4.2 (session 2: the invisible-codepoint denominator).
 # A04 and A15 output caught in session 5 (hidden markup): `html-obfuscation:tiny-font`
 # and `output:html-comment-present`.
+# A05 output caught in session 6 (sequence carriage): `active:markdown-image-sequence`.
 RED = {
-    "A05-output": "each image carries no data, the sequence does: LOW -> WARN (beaconing gap)",
     "A08-output": "natural-language persistence instruction in the output: 0 findings",
     "A09-input": "conditional memory trigger in plain prose: 0 findings",
     "A12-input": "natural-language task with no marker: 0 findings",