chore(deps): bump htmlparser2 from 8.0.2 to 12.0.0 - #110

…ns (#151)

## Summary

Fixes #150. Dependabot PRs were red for reasons unrelated to whether the
knowledge base works. This replaces the version-pinning assertions with
behavioural ones and stops the Mermaid suite from failing on browser
deprecation noise.

- **Parser parity is tested by behaviour.**
`tests/artifact-checks.spec.js` no longer requires the root
`htmlparser2`/`postcss`/`mermaid` versions to match
`actions/package.json`. Instead it runs `actions/lib/check.selftest.js`
(which pins every rule's findings) against whichever parsers the build
resolves. In CI's E2E job that means the root tree, and the actions job
still covers the `actions/` tree. A root parser that parses differently
fails; one that doesn't can land on its own.
- **Dependabot.** `mermaid` leaves the root `ignore` list, because the
Mermaid E2E tests hold the fixture bundle to rendering. A new `/actions`
npm entry (minor/patch grouped) means the dependencies we ship to docs
repos are bumped too.
- **Console noise.** Chromium in Playwright 1.65 reports reframed's
`iframeWindow.addEventListener("unload", …)` (web-fragments 0.8.2) as
`Permissions policy violation: unload is not allowed in this document.`
That exact message is now ignored. Uncaught page errors and every other
console error still fail.
- **Windows.** `check.selftest.js` normalises CRLF before parsing
`contract/RULES.md`. A Windows checkout failed the catalogue check, and
it matters now that the root suite runs the self-test.
- Comments in `scripts/check-artifact.js` and
`scripts/setup-test-apps.mjs`, and `CLAUDE.md`, no longer claim the two
package files are pinned in step.

## Verification

- `npm test`, Playwright 1.62.1 (current pin): 460 passed, 0 failed.
- Root-only `postcss@8.5.32` + `htmlparser2@12.0.0` swapped into
`node_modules` (what #137 and #110 do): the checker self-test passes.
- Mermaid suite on `@playwright/test@1.65.0` (what #149 brings): 6
failures without this change (same as #149's CI), 8/8 pass with it.

## After merge

Rebasing #137, #110 and #149 should turn them green (#149 also needs
#148 merged for its PR Requirements check).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Replaces #110. Dependabot could no longer rebase or recreate it (it
carried a manual merge from master), so this re-applies the same bump on
current master.

Relates to #150: since #151 the root and \`actions/\` may resolve
different parser versions. The checker self-test in
\`tests/artifact-checks.spec.js\` runs against this root htmlparser2 12
and passes locally, along with \`private-registry\` and \`transform\`
(46/46).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>