Squashed 'scanners/commons/' changes from 0ffee85..532d70d

532d70d release(0.2.0): the contract gained a MUST, so the tag has to move
946f51d fix(active-content,conformance): cite line numbers per commit — they do not resolve at the pin
bdcb1f1 feat(conformance): ship the six active-content cases; the id space already existed
807c0d4 feat(spec): add not-applicable, so a single-runtime table stops reading as 7 defects
a1578e6 fix(conformance): record the guard's internal-surface position on _LEX_PAYLOADS
4d351d2 fix(mapping): state that three of four OWASP maps have no production consumer
f082a91 fix(lexicon,docs): retract the claim that the guard's port cites severity.mjs

git-subtree-dir: scanners/commons
git-subtree-split: 532d70d5ed2f9b23a8efad760ef490356cf52ada

conformance/active__autolink/expected.json

@@ -0,0 +1,19 @@
+{
+  "$comment": "Generated from a differential measurement, not written by hand. Normative semantics: spec/conformance-corpus.md. Measurement header and per-runtime provenance: conformance/manifest.json.",
+  "case_id": "active__autolink",
+  "input": {
+    "file": "input.txt",
+    "bytes": 44,
+    "sha256": "effb96b0d00c49dc20622dc4c3c76b969486383bda554ed4c166db1ad506fae5"
+  },
+  "scope": [
+    "signatures/active-content.json"
+  ],
+  "match": "exact-within-scope",
+  "findings": [
+    {
+      "pattern_id": "active:autolink"
+    }
+  ],
+  "observed_out_of_scope": {}
+}

conformance/active__autolink/input.txt

@@ -0,0 +1 @@
+contact <https://evil.test/collect?d=stolen>