test: pin CONTENT-SECURITY.md's enumerated rules to the scanners that enforce them

[hivecommons-hive]

Test Improvement

CONTENT-SECURITY.md is the submitter-facing contract for the imported-architecture gates — it is what a contributor is sent to when validate:architectures or validate:architecture-assets rejects their diagram or page body — and it works by enumeration. Every one of those lists is a copy of a constant in scripts/lib/svg-active-content.mjs, scripts/lib/uri-safety.mjs or scripts/lib/mdx-active-content.mjs, and nothing held the copy to the original.

It had already drifted. ACTIVE_ELEMENTS gained base and meta in 5dad895 (#1245), while the document was written earlier in 29fd4d8 (#1199) and never revisited, so a submitter whose export carried a base element got a CI finding (contains a <base> element) in vocabulary the document does not define — against advice that points at a list the element is missing from.

tests/content-security-contract.test.mjs (new) pins five enumerations:

documented list	enforced by
script-bearing/embedding elements	ACTIVE_ELEMENTS (scripts/lib/svg-active-content.mjs)
embedded-document attributes	DOCUMENT_ATTRIBUTES (same file)
script-executing URI schemes	ACTIVE_SCHEMES (scripts/lib/uri-safety.mjs)
inert inline MDX elements, allowed component	ALLOWED_ELEMENTS / ALLOWED_COMPONENT (scripts/lib/mdx-active-content.mjs)
commands in "Running the validators locally"	package.json scripts

Each is checked in both directions — an undocumented rule rejects submissions for a reason nobody can look up; a documented rule that no longer exists tells submitters to avoid something harmless — and every entry is then run through the scanner it belongs to and asserted to actually produce (or, for the allowed sets, not produce) a finding. Parsing the constant alone would catch a renamed entry and not a dead one, so the behavioural leg is what makes the document pinned to the gate rather than to a constant the scanner might have stopped consulting. Negative controls (<div>, {1 + 1}) keep a list that had swallowed the whole HTML vocabulary from satisfying the allowed-element assertions.

CONTENT-SECURITY.md gains the two missing elements, with the rationale already written in the module's own comment (base re-points every relative reference; meta carries an http-equiv refresh).

Verification

• TZ=UTC node --test tests/content-security-contract.test.mjs — 13 pass, 0 fail.
• Mutation check: removing <meta> from the documented bullet turns the suite red (12 pass / 1 fail), so the pin holds rather than merely reading.
• npm run test:unit:coverage:check exits 0; the new file reports 100.00% lines / 100.00% regions, and harness files stays at 99.57% regions, above the 97% floor.
• npx prettier --check clean on both changed files.

Scope

Disjoint from the open hold-gated PRs: #1319 (tests/helpers-script-sandbox*, package.json floors), #1321 and #1323 (CONTRIBUTING.md parity), #1325 (.npmrc). This PR touches only CONTENT-SECURITY.md and a new test file, and nothing under .github/workflows/.

Related Issue

Closes #1326

---

Filed by quality agent (hold-gated mode). Human review required.

— hive: agent=quality backend=copilot model=claude-opus-5 copilot=1.0.88

[hivecommons-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "quality" agent while Hive policy required a human checkpoint for that agent. Non-outreach agents are held at ACMM L3–L5; the outreach agent is always held because it publishes project-facing communication.

Hive will keep the hold label until a human removes it. Operators can make a deliberate one-off release during an ACMM level change with release_level_holds=true, but level changes never release this hold automatically.