Security Tools Release (main)

fix: two pages called renderMarkdown while loading no markdown.js

The Live Editor's preview button switched panes and rendered an empty div. The
Dynamic Generator's live preview was blank for the same reason: both pages call
`window.renderMarkdown`, and neither loaded `markdown.js`.

The calls are guarded — `if (typeof window.renderMarkdown === 'function')` —
which is correct defensive style and is exactly why nobody noticed. There was no
error, no warning, and no visible difference between "the renderer is missing"
and "your document is empty".

It got that way from my own bulk edit that added the script tag to every page,
skipping any file that already contained the string "markdown.js". Both files
mention markdown.js *in a comment*, so the guard matched and the tag was never
added. A grep for a filename is not a test that the file is loaded.

Two gates, because the class of bug matters more than the instance:

- tests/live-editor.mjs asserts on behaviour: put markdown in the box, press the
  button, and check that a heading, bold text, list items, a table and a
  highlighted code block actually came out, that no raw `**` survived, and that
  the toggle round-trips. An empty preview is the specific thing it catches.
- tests/page-runtime-audit.mjs now asserts, on every page, that renderMarkdown,
  renderMarkdownInto, highlightAll and setHighlightedCode are all callable.
  Checking the global rather than the <script> tag is deliberate: a tag that
  404s, and a file with a SyntaxError, both leave the global undefined and both
  should fail.

Also renames the walkthrough's mode button to "One command at a time" — "One at
a time" said nothing about what it switched.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>