Stabilize Reader's safe-text persistence regression

[NouraldinFarge]

Summary

• fixes the nondeterministic browser test exposed by the post-merge main push run without changing Reader production code
• proves that an exact escaped-text sentinel survives import, IndexedDB storage, reload, and rendering in a separate valid HTML publication
• independently reopens the deliberately malformed mutation-XSS publication after reload and preserves every forbidden-element, forbidden-attribute, foreign-namespace, script-execution, external-request, popup, dialog, and download assertion
• removes the accidental dependency on Chromium retaining a benign paragraph while repairing an intentionally malformed hostile document

Exact review head

64fee55fefe7b7504d9c9df1fcedeb8a09b8ce5d

Why this follow-up exists

The reviewed PR #10 head and its squash-merged main tree are byte-identical. The PR browser job passed once, but the fresh main push run reproduced encodedBoundary: undefined. That showed the original fixture was nondeterministic: Chromium can discard the benign sibling paragraph while repairing the deliberately malformed attack document. The sanitizer still failed closed in both runs; every forbidden element, attribute, namespace, and execution probe remained absent.

This repair keeps the exact escaped-text assertion and the hostile persistence assertions, but no longer asks one malformed document to prove both unrelated contracts.

Local verification on August 25, 2026

• formatting, ESLint, Stylelint, and Markdownlint passed
• 40/40 unit, parser-policy, persistence, structure, and desktop-shell tests passed
• 21/21 high-risk coverage tests passed: 99.19% lines/statements, 89.67% branches, and 100% functions in the designated modules
• two focused Chromium 151 hostile-journey runs passed every Reader application assertion and reached only the final fail-closed network check, where locally installed AdGuard injected requests to local.adguard.org; that assertion was not filtered or relaxed
• the commit has a verified SSH signature

The clean hosted browser/accessibility, Windows/Rust packaging, and CodeQL jobs on this exact head are required before merge. Earlier green results are not reused.

Product and release boundary

Reader remains a public-source Windows alpha with no supported binary or GitHub Release. The CI candidate remains unsigned, and the clean Windows 10/11 install, upgrade, uninstall, and residual-data matrix remains incomplete. This test-only repair creates no release or professional-profile claim.

Merge boundary

Do not merge unless every required hosted check on 64fee55fefe7b7504d9c9df1fcedeb8a09b8ce5d succeeds. After merge, the fresh main push matrix must also complete successfully before Reader is pinned or promoted.