gate the raw-HTML default instead of remembering it

Since Arc 1 the latent list has carried "raw HTML is omitted only because
goldmark's default omits it". Shortcodes were the trigger, and they came and went
without needing unsafe mode — a call renders a theme template (ADR-0036). So the
right close is not a note saying we got away with it, but a gate: verify.sh now
fails on WithUnsafe in any non-comment line under cmd/ or internal/.

Proved both directions before keeping it. The first version also failed on the
comment in render.go that explains the rule — a gate that fires on its own
documentation is one nobody keeps, so it now skips comment lines. That is the
seventh gate defect found by running against real code rather than reasoning
about it.

The latent row is gone rather than reworded, and the untrusted-boundary row says
which half is now mechanism and which half still isn't.

scripts/verify.sh

@@ -100,6 +100,20 @@ if [ -d .git ] && command -v git >/dev/null 2>&1; then
     fi
   fi
 
+  # Invariant 2, as mechanism rather than memory. goldmark drops raw HTML by default, and that default is
+  # the only thing standing between an authored Markdown file and script injection. A shortcode wanting to
+  # emit HTML renders a theme template instead (ADR-0036), so nothing in this engine has a reason to turn
+  # it off — and the day something seems to, it should have to argue with a failing gate first.
+  # Comment lines are excluded: the rule is worth explaining next to the code it governs, and a gate that
+  # fires on its own documentation is a gate nobody keeps.
+  unsafe=$(grep -rn 'WithUnsafe' --include='*.go' cmd internal 2>/dev/null |
+             grep -vE ':[0-9]+:[[:space:]]*//' | cut -d: -f1,2 || true)
+  if [ -n "$unsafe" ]; then
+    bad "html.WithUnsafe enables raw HTML from authored content (ADR-0003, ADR-0036): $(echo "$unsafe" | tr '\n' ' ')"
+  else
+    pass "raw HTML stays disabled"
+  fi
+
   # Dangling references. Every one of these found a real stale pointer when run by hand.
   refs=$(grep -rhoE '`(docs|scripts|ideas|reference|\.claude)/[A-Za-z0-9_./-]+`' \
            docs CLAUDE.md HARNESS.md ideas reference .claude scripts 2>/dev/null | tr -d '`' | sort -u)