Harden Markdown conversion and extension permissions

[Stem0794]

What changed

• pin Marked to 18.0.9 and generate the browser bundle from the exact locked npm dependency
• add a strict final HTML sanitizer and disable Markdown image rendering
• add regression tests for image-alt injection, unsafe URLs, raw HTML, and the former link-label ReDoS shape
• remove dynamic script injection and narrow extension permissions by dropping scripting and activeTab
• scope context-menu actions to Gmail and route conversion commands through the existing Gmail content script
• remove unnecessary web-accessible resources
• remove the duplicate injector.js conversion path and stale vendored Marked 15 bundle
• make the shipped HTML-to-Markdown converter the one exercised by unit tests
• replace Mocha with Node's built-in test runner, eliminating the vulnerable serialize-javascript dependency chain
• add an exact dependency lockfile, strict npm audit, full Playwright E2E coverage, CI, and Dependabot
• preserve Gmail's native rich-content paste behavior when convert-on-paste is disabled
• stop conversion shortcuts from guessing the first open draft when no compose editor is active
• batch broad Gmail DOM observer work instead of rescanning immediately on every mutation
• apply storage option changes to the active Gmail page without requiring a reload
• update README source-build and security documentation

Why

The repository was shipping Marked 15.0.12 while tests exercised a different 9.x dependency. The shipped parser predated upstream XSS and ReDoS fixes, generated HTML was inserted into Gmail without a final allowlist sanitizer, and the background worker could attempt script injection into whichever tab was active. The review also identified a few lower-risk Gmail integration issues around paste handling, draft targeting, and mutation-observer overhead.

Developer impact

Source installs require Node.js 20+. npm ci installs the exact locked dependency set and generates vendor/marked.umd.js from the pinned Marked version. npm run build:zip refreshes that generated bundle before packaging.

Validation

GitHub Actions passes all required checks on the final PR head:

• npm ci
• npm audit --audit-level=low — 0 vulnerabilities
• npm test — 62 unit/security tests passing
• npm run test:e2e — 88 Playwright tests passing
• npm run build:zip — Chrome Web Store package builds successfully