fix(email): enforce canonical token provenance boundaries (Issue #71 Slice 1)

[TheAggressive]

Summary

Enforces canonical email token provenance and removes static resolver/denylist bypass patterns.

Changes

• Token_Resolver::tag() — removed the early-return bypass that skipped anchor validation for segments without raw ({{)) syntax. Entity-encoded tokens in hrefs are now correctly validated.
• Renderer_Support::link_url() — removed the static (Token_Resolver::default()) fallback. Token-bearing URLs now pass through to the compiler-injected resolver for validation.
• Tests — added regression tests for entity-encoded token syntax, non-recursive local value resolution, and HTML encoding of local values. Updated renderer pass-through tests to reflect the new boundary.

Verification

• (pnpm qa:fast) — all checks pass (composer, lint, typecheck, format, phpstan, 130 JS tests)
• Full PHP suite: 1068 tests, 4820 assertions — OK
• Focused tests: 80 tests, 258 assertions — OK

Closes #71 (Slice 1)