Address PR #5 review: tighten validator and template

[SunnyDevendranadh]

Addresses the 5 minor issues from the code review:

• no-external-deps: detect dynamic import() via lookbehind; scope ESM import/export to <script> blocks. Lookbehind fixes a line-number off-by-one when the prefix newline was being captured.
• no-hardcoded-hex: mask url(...) contents and quoted strings before scanning, so URL fragments like icon-3f4a2b.png or #abc123 no longer false-positive as colors.
• security-hardening: rewrite the innerHTML check to capture the RHS and inspect it programmatically. Now correctly:
  • passes static string literals ("..." or '...')
  • passes backtick templates without interpolation
  • flags template literals containing ${ ... }
  • flags bare variable assignments Error message distinguishes "template literal with interpolation" from "non-literal expression".
• tests: add explicit "zero issues" assertion for valid.html; add new valid-with-urls.html fixture covering hex-like strings inside url() / quotes; extend security fixture with template-literal cases.
• status-report-v2.html: replace orphan anchors with — same styling, no broken links.