feat(active-content): raw HTML graded on carrier, and a tag naming no target is inert

Two changes that had to ship together, because they co-occur.

`active:raw-html-link` (MEDIUM) splits the click-required carriers out of
`active:raw-html`. The same URL was LOW as `[t](url)` and HIGH as
`<a href="url">` — an asymmetry produced by syntax, not by affordance, on a
carrier the markdown path has graded MEDIUM since 0.3.1. The event-handler test
runs first, so `<a onclick=...>` stays HIGH. The url-attribute branch stays HIGH
too: a name outside the active set has unknown rendering, and grading
`<Card src=...>` as a link would be reasoning rather than measurement.

The no-URL narrowing makes `</a>`, `<Frame>`, `<video />` and `<img alt=...>`
without `src` inert — `<base />`'s argument from 0.6.0 applied to the rest of the
name branch. It tests for the URL attribute's PRESENCE, not for a readable value,
so the fail-secure gap `_url_attr_is_external` leaves open is not reopened here.

WHY TOGETHER: the narrowing strips a document's `</a>`/`<Frame>` and what remains
is the `<a href=...>` the split grades down, so each alone leaves the document
blocked by the other's residue.

`active_tag_class` is now the classification point and `is_active_tag` wraps it.
The census patches the former: a boolean could only express a narrowing, never a
regrade, so every carrier candidate would have measured equal to PRODUCTION —
silently, and in the direction that reads as "no change helps".

TWO COSTS, BOTH RECORDED RATHER THAN GLOSSED:

- The split TIGHTENS the trusted tier. One finding becomes two, and >=2 findings
  at MEDIUM+ trip the compound overlay, so a document carrying both an `<img src>`
  and an `<a href>` goes WARN -> quarantine_review on PRESET_TRUSTED_SOURCE. On
  that preset it is the only direction the split can move anything. The census
  now reports a TIGHTENS column on both trust tiers against the previously
  shipped row — "frees N" without "tightens M" is a one-sided number.
- `count` drops on documents containing `</a>`, a published field moving under a
  meaning that did not change.

MEASURED: reference-corpus (389) 54 -> 53 fail_secure, tightens 0/0, and the
census `PRODUCTION` row equals its `C1 + D` candidate row for row. The census
also reproduces 133/3/13/108/25 exactly, so it is calibrated against every
published historical number. The two wiki corpora are NOT yet re-measured; the
tree says so explicitly in the docstring, LIMITATIONS and CHANGELOG rather than
carrying probe numbers as fact.

791 tests (was 759), coverage 129/129, 6/6 documented gaps holding. Version
bumped to 0.7.0 across every surface; no tag is set until the measurement lands.

tests/test_wiring.py

@@ -183,11 +183,38 @@ def test_inert_vendor_doc_html_is_not_active(text):
 
 
 @pytest.mark.parametrize("text", [
-    '<a href="https://x.example/p">here</a>', '<img src="https://x.example/a.png">',
-    '<div onclick="x()">clickme</div>',
+    '<img src="https://x.example/a.png">', '<div onclick="x()">clickme</div>',
+    '<iframe src="https://x.example/x"></iframe>',
 ])
-def test_active_raw_html_still_fails_secure_on_upload(text):
-    # The other half of the same correction: `a` and `img` are active by name, so
-    # hand-written links and images in raw HTML *are* caught. The overcount is in
-    # the formatting tags above, not in a weakened rule.
+def test_zero_click_raw_html_still_fails_secure_on_upload(text):
+    # The other half of the same correction: `img` is active by name, so a
+    # hand-written image in raw HTML *is* caught. The overcount is in the
+    # formatting tags above, not in a weakened rule.
     assert screen_output(text, PRESET_USER_UPLOAD).disposition is Disposition.FAIL_SECURE
+
+
+def test_split_tightens_the_trusted_tier_when_both_carriers_are_present():
+    # The cost side of the carrier split, pinned because it runs OPPOSITE to the
+    # change's purpose. Splitting one class into two means a document carrying
+    # both an `<img src>` and an `<a href>` now emits TWO findings at MEDIUM+
+    # where it emitted one, which trips the compound overlay: WARN through 0.6.1,
+    # QUARANTINE_REVIEW from 0.7.0. On the trusted preset nothing was hard-failed
+    # to begin with, so this is the only direction the split can move it.
+    both = ('<img src="https://x.example/a.png?d=1"> '
+            'and <a href="https://x.example/p?d=2">t</a>')
+    assert screen_output(both, PRESET_TRUSTED_SOURCE).disposition is Disposition.QUARANTINE_REVIEW
+
+    # The same document with only the zero-click carrier still WARNs on trusted:
+    # the escalation comes from the second finding, not from a changed severity.
+    only_img = '<img src="https://x.example/a.png?d=1">'
+    assert screen_output(only_img, PRESET_TRUSTED_SOURCE).disposition is Disposition.WARN
+
+
+def test_raw_anchor_is_held_for_review_not_hard_failed():
+    # 0.7.0's carrier split. A raw anchor was FAIL_SECURE through 0.6.1 while the
+    # identical markdown link was WARN — an asymmetry of syntax, not affordance.
+    # It is now held for a human like every other click-required carrier. Pinned
+    # HERE, at the composed gate, because what a consumer feels is the
+    # disposition, not the label: this must never reach WARN either.
+    result = screen_output('<a href="https://x.example/p">here</a>', PRESET_USER_UPLOAD)
+    assert result.disposition is Disposition.QUARANTINE_REVIEW, result