fix(adapter-wp): srcset 审计精确化（parse-srcset）；false 形态防御；复用 launder.naughtyHref；等价测试参数化

审查修复四项：srcset 逐候选审计改用 parse-srcset 同库实现（data: 逗号内嵌
URL 不再误切；全候选被拒/解析异常/零候选→整属性删除记账，含空 srcset）；
deriveMirrorView 对 false/缺省形态 fail fast（allowedTags/allowedAttributes
的 false=库全放行语义与镜像空集解释相反，修正原注释）；URL 判定复用
launder.naughtyHref（sanitize-html 2.18 同一实现路径，删手写镜像）；
仪表化等价测试参数化为 15 个对抗样本（实体/控制字符/NULL/URL 注释走私、
未引号/重复属性、深嵌套、srcset 形态）。测试 204→228。

Co-Authored-By: Claude Code <noreply@anthropic.com>

pnpm-lock.yaml

@@ -66,6 +66,12 @@ importers:
       '@sf/contracts':
         specifier: workspace:*
         version: link:../contracts
+      launder:
+        specifier: ^1.7.2
+        version: 1.7.2
+      parse-srcset:
+        specifier: ^1.0.2
+        version: 1.0.2
       sanitize-html:
         specifier: ^2
         version: 2.18.1
@@ -73,6 +79,9 @@ importers:
         specifier: ^6.0.0
         version: 6.0.0
     devDependencies:
+      '@types/parse-srcset':
+        specifier: ^1.0.0
+        version: 1.0.0
       '@types/sanitize-html':
         specifier: ^2.16.2
         version: 2.16.2
@@ -924,6 +933,9 @@ packages:
   '@types/node@22.20.5':
     resolution: {integrity: sha512-U2+DNr+wSjpsTS/wZGYHq7GcwfuSmKiKvoPvK22zwTlRhU91yOniN4qRR5KhIjvif7ysw/dz/hKmfDH0Ris4aA==}
 
+  '@types/parse-srcset@1.0.0':
+    resolution: {integrity: sha512-5ehc1s3aIQJ05ZVAmYoqDUN8zvlrIZvRUfYP+2bhGNzrY5RQBeJS9JO9jpkVm/vSOW/MkRYLArS/fhXY5cgXPg==}
+
   '@types/sanitize-html@2.16.2':
     resolution: {integrity: sha512-kuAbgDCFv418flrp3z4o/4ufLA/5ovmXRH0L419iZCPGO7w00znjeDI5Wy/KZWNIBpDQc7hucCK+J5almB6FyA==}
 
@@ -2279,6 +2291,8 @@ snapshots:
     dependencies:
       undici-types: 6.21.0
 
+  '@types/parse-srcset@1.0.0': {}
+
   '@types/sanitize-html@2.16.2':
     dependencies:
       htmlparser2: 12.0.0