feat(web): canonical Markdown, Mermaid, and headless acceptance

[hartsock]

Rebased directly onto main; this PR is independent of the draft Psyche integration branch #1492.

What this PR does

• keeps harness and transcript output canonical GFM Markdown while treating the TUI and HTMX UI as presentation adapters
• progressively enhances fenced Mermaid diagrams in newt-web with a locally vendored, pinned Mermaid 11.15.0 bundle under strict security settings
• preserves invalid diagrams as readable Markdown source and keeps non-Mermaid fences as ordinary code
• re-enhances Markdown after HTMX swaps and live SSE transcript updates
• adds real headless Chromium BAT and phone-sized UAT workflows, plus release/manual GitHub Actions tiers
• documents the portable enriched-Markdown surface and adds the required newt-web crate README

Test plan

• cargo build --workspace
• just check
• just cov-ci (87.78% measured line coverage; 80% floor)
• cargo test --manifest-path newt-web/Cargo.toml
• cargo clippy --manifest-path newt-web/Cargo.toml --all-targets -- -D warnings
• cargo fmt --all -- --check
• npm run test:acceptance (real Chromium BAT + mobile UAT)
• git diff --cached --check

Out of scope

• redesigning genuine native Rich TUI widgets or defining a universal widget IR beyond the first Mermaid Markdown extension
• live-LLM acceptance tests; those remain in the existing eval-live tier
• changing the newt-web authentication or deployment architecture

---

Note

Medium Risk
Touches untrusted model HTML rendering and third-party diagram JS in the browser, plus new CI dependencies (Playwright/Chromium); mitigations include ammonia sanitization, Mermaid strict mode, and deterministic simulated-backend tests.

Overview
Codifies GFM Markdown as the shared transcript contract and treats newt-web as a presentation adapter: server-side rendering stays sanitized HTML, with fenced mermaid blocks marked for browser-only enrichment.

Adds local Mermaid support via a pinned 11.15.0 vendored bundle, markdown.js (newtEnhanceMarkdown with securityLevel: "strict"), and re-enhancement after HTMX swaps and SSE transcript updates. Invalid diagrams keep readable source with an error affordance; non-Mermaid fences stay normal code.

Introduces Playwright headless acceptance (BAT on PRs/main, UAT on release/** and manual dispatch) wired into newt-web.yml with Node/Chromium install and report artifacts. Repo hygiene updates un-ignore the harness (package.json, tests) and mark mermaid.min.js binary in .gitattributes.

Documentation expands newt_web_htmx.md, bat-uat.md, and adds newt-web/README.md plus asset README/license notes.

^{Reviewed by Cursor Bugbot for commit 87980d2. Configure here.}