render the HTML an author writes, and narrow the gate to one call site

Dropping raw HTML was silently destructive. H<sub>2</sub>O rendered as "H2O",
10<sup>6</sup> as "106", <kbd>Ctrl</kbd> as "Ctrl", and khosra check reported
nothing — an author lost meaning with no signal anywhere. Measured on the real
binary before and after.

Invariant 2 already says content from the site root is trusted, so the old gate
was defending the half of the boundary that was never in question while the
untrusted half has no code to defend yet. Chemistry, units, exponents and
keystrokes are what a hard-science site needs and what no Markdown dialect
expresses, so html.WithUnsafe() goes on in internal/render/render.go.

The gate does not disappear; it narrows. verify.sh used to fail on WithUnsafe
appearing anywhere and now fails unless it appears in exactly that one file —
watched doing both, accepting one call site and naming both files when a second
appears. A second pipeline trusting its input is the failure ADR-0003 exists to
prevent, and when comments arrive they get their own goldmark without it. The
gate is the reminder that the split has to be built rather than assumed.

The security test that asserted "raw HTML must still be dropped" now asserts the
property that actually holds and matters more: a shortcode argument stays data
whatever the page around it is allowed to do. ::figure{alt=<b>bold</b>} still
arrives as &lt;b&gt; while the <span> beside it renders.

core 2793/2800, ext 1077/2000, 34 gates green, 0 warnings.

internal/render/render.go

@@ -17,6 +17,7 @@ import (
 	"github.com/yuin/goldmark"
 	"github.com/yuin/goldmark/extension"
 	"github.com/yuin/goldmark/parser"
+	"github.com/yuin/goldmark/renderer/html"
 
 	"khosra/internal/content"
 )
@@ -133,8 +134,9 @@ func New(siteFS fs.FS, settings content.Settings, extend func(Partial) []goldmar
 	// an author's words (ADR-0034), and it is a parser option rather than a render transform, so it does
 	// not move the transforms counter.
 	//
-	// Raw HTML stays disabled — goldmark's default — so the only HTML a page carries comes from a template
-	// (ADR-0036, invariant 2). Nothing here may enable html.WithUnsafe.
+	// Raw HTML renders, because content from the site root is trusted (invariant 2, ADR-0060). This is the
+	// *one* renderer allowed to say so, which `verify.sh` enforces by counting the call: an untrusted source
+	// — a comment, a webmention — gets its own goldmark without this option, never this one.
 	extensions := []goldmark.Extender{extension.Typographer}
 	if extend != nil {
 		extensions = append(extensions, extend(r.Partial)...)
@@ -142,7 +144,8 @@ func New(siteFS fs.FS, settings content.Settings, extend func(Partial) []goldmar
 	// Heading IDs are a parser option rather than an extension, and they are the engine's half of a table of
 	// contents: the anchor has to exist before a theme can link to it (ADR-0058).
 	r.md = goldmark.New(goldmark.WithExtensions(extensions...),
-		goldmark.WithParserOptions(parser.WithAutoHeadingID()))
+		goldmark.WithParserOptions(parser.WithAutoHeadingID()),
+		goldmark.WithRendererOptions(html.WithUnsafe()))
 	return r, nil
 }