Summary

Fix the sanitizer boundary so reading Markdown/code-bearing GitHub content no longer silently deletes or truncates source that may later be written back.

• keep the strict HTML policy for short metadata such as titles
• add a Markdown-aware content policy for bodies, comments, reviews, release notes, status updates, and commit messages
• preserve inline, fenced, and indented code byte-for-byte where syntax is meant to be literal
• make render-hidden Markdown constructs visible instead of deleting their contents
• neutralize literal and entity-encoded invisible controls, hidden fence metadata, HTML comments/blocks, unused metadata, GitHub math, footnotes, images, and non-visible link labels
• apply the same policy to direct sub-issue response paths
• retain allocation-free handling for ordinary clean text and bound adversarial fixed-point work

Security boundary

Valid non-empty HTTP/HTTPS/mailto/relative link destinations remain functional because GitHub exposes them on hover/click. Non-URL-like, titled, image, empty-label, full-reference, unused, and duplicate forms are made visible.

Rich content removes variation selectors and zero-width joiners rather than trying to validate the full Unicode variation/grapheme registries. Visible base characters remain, but presentation may change. GitHub-rendered diagram/math fence types are returned as visible source rather than opaque rendered output.

Validation

• script/lint
• script/test
• script/licenses-check
• repeated 30-second FuzzContentIsIdempotent runs covering idempotence, rendered hidden-rune safety, hidden Markdown constructs, and adversarial nesting
• dedicated security and correctness review passes during implementation

Fixes #2202
Fixes #3165