feat(markdown): support Markdown-It 13 hosts

[CodeinScrubs]

Outcome Expands @bidilens/markdown from Markdown-It 14-only peer resolution to the widely deployed Markdown-It 13.0.2+ and 14.x lines without leaking either host's @types/markdown-it graph through BidiLens declarations. This is a concrete adoption fix for hosts such as n8n's @n8n/chat, whose current renderer uses Markdown-It 13 and does not accept raw HTML. Before this change, a strict Markdown-It 13 consumer failed peer resolution; an intermediate compatibility attempt also exposed a real v14 type-declaration conflict. ## Design and tradeoffs - Public functions now accept a narrow structural MarkdownItCompatible boundary while the implementation retains Markdown-It 14 types internally. This avoids forcing one DefinitelyTyped major on supported hosts, at the cost of intentionally exposing only the parser surface BidiLens actually consumes. - @types/markdown-it moves from runtime dependencies to development dependencies. The compatibility harness rejects any future declaration import or runtime type dependency regression. - Runtime source, stored Markdown, parser ownership, raw-HTML settings, and the pure-LTR identity contract remain unchanged. - No claim is made for Markdown-It 12 or future 15; those remain outside the declared and tested range. ## Permanent compatibility gate A clean packed consumer is created independently for: - markdown-it@13.0.2 + @types/markdown-it@13.0.9 - markdown-it@14.3.0 + @types/markdown-it@14.1.2 Each consumer installs with strict peer dependencies, compiles with strict TypeScript and skipLibCheck: false, checks that packed declarations do not import Markdown-It types, and executes: - all 932 canonical fixtures; - eight Markdown host-structure fixtures; - plugin, batch, one-code-point streaming, source-identity, security, isolation, AST, and HTML assertions; - an exact cross-version report comparison over all 940 fixtures. The gate is part of CI, verify:production, and release preparation. Strict main protection now requires it as the nineteenth CI job (24 total contexts with five CodeQL analyses). ## Local evidence - pnpm run check — 401 tests; 932 corpus cases; 69 docs; type/lint/build/action checks; 92.03% statement coverage - pnpm run markdown-it:compat — both strict packed consumers passed; identical 940-fixture reports - pnpm run packages:types — all 12 published package type layouts passed - pnpm run test:visual — 27/27 across Chromium, Firefox, and WebKit - pnpm exec tsx scripts/release-check.ts --allow-dirty — all 12 packed artifacts, clean consumer, runtime/CLI probes, and packed examples passed - pnpm run deps:audit — no known vulnerabilities - pnpm run sbom && pnpm run sbom:check — CycloneDX 1.7; 580 components; 594 relationships - pnpm run typecheck && pnpm run lint && pnpm run docs:check && git diff --check — passed after final hardening ## Release boundary This draft does not publish packages and does not modify the already rehearsed 0.3.1 source on main. Its changeset is a future patch release after hosted review and merge. A prior Linux gate failure was diagnosed as unsafe per-chunk UTF-8 decoding in this new harness; the harness now uses stateful stream decoding, preserves the full equality assertion, emits the first differing path, and uploads reports only on failure.