[LawrenceYoong]

What changed

• Render fenced Mermaid blocks in the project docs bookshelf, loading Mermaid only when a document contains a Mermaid block.
• Keep rendered SVGs in strict security mode and sanitize them with DOMPurify; invalid diagrams and load failures leave the sanitized source readable.
• Document Mermaid support in the README and feature guide.

Validation

• npm run typecheck — passed.
• npm run build — passed.
• Playwright headless browser check — passed: valid and HTML-injection diagrams render as SVG; no injected image/script nodes appear; invalid Mermaid source remains visible. Screenshot reviewed locally.
• npm test — 613 passed, 1 failed. The failing PR mock test (tests/repos.test.ts, “O opens a pull request in each repository…”) was reproduced unchanged on a clean worktree of origin/main at 852e2ab.