[bits-bytes-nn]

Summary

• Adds _plugins/safe_post_html.rb: a post_convert hook that parses each post's rendered body with Nokogiri's HTML5 parser and fails the build on markup that would run code or load a document: active elements (script, object, base, meta, form, ...), on*/srcdoc/formaction attributes, and URL attributes whose scheme is not http(s), mailto, tel, relative, an anchor, or an inline image.
• It checks kramdown's output, so raw HTML, links, images and attribute lists are all judged as the browser reads them (entities decoded). Code blocks are text and pass.
• Generated posts arrive as PRs, so a failing build blocks the merge instead of rewriting the post.

Test plan

• ruby test/run_all.rb: 192 runs, 0 failures (15 active and 11 safe cases added)
• bundle exec jekyll build: all 38 existing posts build unchanged
• A scratch post with <img onerror> fails the build with the post path; the same text in a code span builds