render the HTML an author writes, and narrow the gate to one call site

Dropping raw HTML was silently destructive. H<sub>2</sub>O rendered as "H2O",
10<sup>6</sup> as "106", <kbd>Ctrl</kbd> as "Ctrl", and khosra check reported
nothing — an author lost meaning with no signal anywhere. Measured on the real
binary before and after.

Invariant 2 already says content from the site root is trusted, so the old gate
was defending the half of the boundary that was never in question while the
untrusted half has no code to defend yet. Chemistry, units, exponents and
keystrokes are what a hard-science site needs and what no Markdown dialect
expresses, so html.WithUnsafe() goes on in internal/render/render.go.

The gate does not disappear; it narrows. verify.sh used to fail on WithUnsafe
appearing anywhere and now fails unless it appears in exactly that one file —
watched doing both, accepting one call site and naming both files when a second
appears. A second pipeline trusting its input is the failure ADR-0003 exists to
prevent, and when comments arrive they get their own goldmark without it. The
gate is the reminder that the split has to be built rather than assumed.

The security test that asserted "raw HTML must still be dropped" now asserts the
property that actually holds and matters more: a shortcode argument stays data
whatever the page around it is allowed to do. ::figure{alt=<b>bold</b>} still
arrives as &lt;b&gt; while the <span> beside it renders.

core 2793/2800, ext 1077/2000, 34 gates green, 0 warnings.

HARNESS.md

@@ -106,11 +106,12 @@ staging a subset — a changed signature without its caller — produced a commi
 `verify.sh` reported green, and a broken commit is something `git bisect` trips over for as long as the repo
 lives. It only runs when something is staged.
 
-**The injection boundary is a gate now, not a memory.** goldmark drops raw HTML from authored Markdown by
-default, and that default was the only thing standing between a Markdown file and script injection. A
-feature wanting to emit HTML renders a theme template instead (ADR-0036), so nothing here needs raw HTML
-enabled — and `verify.sh` fails on `WithUnsafe` appearing in any non-comment line under `cmd/` or
-`internal/`. Anything that genuinely needs it must argue with a failing gate first, which is the point.
+**The injection boundary is a gate now, not a memory.** Raw HTML renders for site-root content, because
+that content is the author's own (ADR-0060) — and the *trusted* half of that sentence is the whole claim.
+`verify.sh` fails unless `html.WithUnsafe()` appears in exactly one file, `internal/render/render.go`. A
+second call site means some other input has been handed the pipeline that trusts its author, which is the
+failure ADR-0003 exists to prevent; when comments arrive they get their own goldmark without it. A feature
+wanting to emit HTML still renders a theme template instead (ADR-0036).
 
 ## Coming back after a long absence