v3.2.0 - Audit fixes (toolbar buttons, channel-2 sandbox, security hardening)

Full remediation of the 2026-09 deep review (A/B/C/D/E/F/G lists), runtime marker version 5.

Critical fixes

A1: ??/??/?? toolbar buttons referenced an undefined variable - now work
A2 + B1: channel 2 (bare <div class="mdt"> fragments) no longer uses shadow DOM + innerHTML in the parent origin - unified into the same sandboxed-iframe pipeline
B2: new-tab preview uses a CSP with sandbox allow-scripts - the top-level tab is opaque too
B3: postMessage now carries a mount id (O(1) lookup) + ev.source verification
B4: KaTeX maxExpand/maxSize + per-formula length + per-fence count caps + result LRU cache
B6: vendor/katex VERSION + SHA256SUMS, verified in CI

Cross-platform Node installer install.mjs (Windows/Linux/macOS, npm/pnpm/bun/global paths)
PS installer: last-</body> injection, atomic writes, stale-backup discard on uninstall
KaTeX/CSS load retry (?3 exponential backoff) + __dshHtmlRenderer.resetKatex()
30s streaming-stuck timeout, _pending frame replay, oversized-fence lifecycle
SECURITY.md / CONTRIBUTING.md / .gitignore / package.json, version-consistency CI
Deferred (documented in CHANGELOG): incremental DOM scanning, Playwright e2e, ESLint suite

Install (local/self-hosted DSH):

node install.mjs          # cross-platform, or .\install-dsh-html.ps1 on Windows
node install.mjs --check

Then Ctrl+F5 the DSH web GUI and paste a ```dsh-html fence.