v0.88.1: dev-backend fixtures, mermaid passthrough

The dev-backend pass. Fixes the two local-development blindspots and one renderer gap:

• A mermaid fence now passes through the build-time Shiki highlighter untouched, keeping its language-mermaid class on the <code> element. A site's client-side mermaid renderer can key on the class directly; the site-side marker-plugin workaround is no longer needed.
• @glw907/cairn-cms-dev seeds two published fragments (manifest rows plus bodies, one mirroring the showcase's trail-safety-notice), so the fragment picker, include-chip title resolution, and preview splice all work under vite dev.
• @glw907/cairn-cms-dev's seeded media objects are real, browser-decodable 240x160 PNGs (a distinct solid color per asset) instead of a 12-byte stub, so the Media Library shows real thumbnails locally instead of "Image missing" on every tile.

Also in this window: a getPlatformProxy media-delivery smoke so the miniflare RPC-serialization class fails in CI rather than on a consumer's first vite dev; the check:custom-surface and check:chassis-boundary gates wired into CI; the editor's media chip no longer decorates a media: token inside a fenced code block, and figureRoleAtLine reads the anchored attrs group; theme-import and preview-iframe documentation.

Consumers must: nothing. All changes are additive, dev-package-internal, or non-breaking behavior fixes.