Adopt HtmlForgeX 0.50 Markdown contracts

[PrzemyslawKlys]

Summary

• migrates documentation HTML export to the explicit HtmlForgeX trusted-CSS contract
• adopts the renamed Markdown trusted-HTML options and removes obsolete sanitizer/raw flags
• keeps repository and release Markdown non-executable by default
• updates HtmlForgeX to 0.50.0, HtmlForgeX.Markdown to 0.21.0, and OfficeIMO.Markdown to 0.6.42
• adopts public HtmlTinkerX 2.2.0 as the shared HTML-analysis runtime
• removes the vulnerable AngleSharp 1.4.1-beta.523 graph by using the HtmlTinkerX-owned AngleSharp 1.5.2 stack
• removes the conditional sibling-project/package dependency switch so there is one package-owned route
• merges current main, including PowerForge 1.0.4, without weakening the 0.50 cleanup contracts

Markdown security decision

The former OfficeIMO options did not provide the advertised sanitization boundary. This PR does not replace them with a broad trust acknowledgment: raw documentation HTML stays non-executable, with regression coverage for details, summary, and script input.

Dependency state

HtmlTinkerX 2.2.0 is public on NuGet. All affected web lock graphs resolve that version with content hash qB7S0sMrR/nnVwu0qpq0uKE4IrWOj2GCgSrUHYi7zrCCNmVaewDGtqly3JxMRGNsJA/iIUzXM9h8fgsUGWxVZQ== and the AngleSharp 1.5.2 / Css beta.216 / Js beta.49 dependency set.

HtmlForgeX 0.50.0 and HtmlForgeX.Markdown 0.21.0 still depend on EvotecIT/HtmlForgeX#226 and are not public. CI may remain restore-blocked on those packages; no compatibility bridge or temporary feed is committed.

The pre-publication HtmlForgeX lock hashes remain validation-only and must be refreshed from the final public package bytes after the post-merge CDN release.

Validation

• exact reviewed and pushed head: baf360d6f62c91ea9f918ca8874237f4469de81f
• independent merge-resolution review: no actionable findings
• all main-only paths are blob-identical to origin/main; branch security and Markdown changes remain intact
• affected graph restores with public HtmlTinkerX 2.2.0 and locally packed HtmlForgeX 0.50 packages
• PowerForge.Tests: 4,304 passed
• net472 builds pass for PowerForge, PowerForge.PowerShell, and PSPublishModule with zero warnings and errors
• no stale HtmlTinkerX 2.1.0 beta or 2.0.20 references, conflict markers, or invalid lock files remain

After HtmlForgeX 0.50 is public, refresh the HtmlForgeX family locks from NuGet and rerun the GitHub jobs. No downstream workaround is required.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.