Add v3 publication parser + link-renderer suite

Details

Loads db_assets.js + publication-list.js into one vm context (browser <script>
order) and pins the markdown-ish parser (v3ParsePub / v3ExtractVenue) plus the
security-critical link renderer: external links get target=_blank rel=noopener,
every field is HTML-escaped, and a javascript:/data: URL is routed through
dbSafeExternalUrl to '#'. Verified end-to-end in a real Chromium drive of the
built site (the helper collapses javascript:/data: to '#' live across the
theme/weather/season/viewport matrix); this locks it in deterministically.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Dqq3yLFbZnaCYwTcZZEZRU

Files changed (2)