emrg: gui renderer — restore production markdown/hljs wiring + vanilla CSS (Batch 5 promise items)

[how2how2how2-arch]

Summary

Restores two production-quality items that the Batch 5 final switch (#1023/#1024) shipped without, both explicitly promised by the migration design:

1. Chat markdown + code highlighting were degraded to escaped plain text.TranscriptView falls back to createMarkdownRenderer({ t }) (no deps) because no one wired the real vendor libs; ResultPanel reads window.hljs which is never set (ResultPanel comment literally says "Batch 5 接真实 hljs").
2. The vanilla css/ suite (tokens/base/components/layout/animations, ~2718 lines) was deleted with the vanilla renderer (emrg: gui renderer Batch 5 cleanup — delete vanilla renderer + legacy vm.runInContext tests #1024) but never re-imported into the React bundle. React components reference var(--token) variables (from tokens.css) and the vanilla class names (components.css/layout.css) — the shipped GUI renders with no theme (inline var() unresolved) and no chat styling. The TranscriptView contract says "复用 vanilla CSS，无需改样式表" (reuse vanilla CSS unchanged).

Changes

• renderer/src/lib/vendorMarkdown.ts (new): wires the real vendor deps into the bundle — marked.min.js / dompurify.min.js as default imports (UMD), highlight.custom.js as a side-effect import (sets window.hljs at runtime, no-op at build time), plus the highlight.github-dark.css theme. Exports createProdMarkdownRenderer() following the design's construct-injection pattern.
• renderer/src/lib/vendorMarkdown.test.ts (new, 4 tests): asserts real markdown renders (<strong>, <code>, links), code blocks get hljs language + token spans, window.hljs is available (ResultPanel contract), and DOMPurify sanitizes XSS.
• renderer/src/vendor.d.ts (new): module declarations for the UMD vendor files.
• renderer/src/components/Shell.tsx: passes the production renderer to TranscriptView (useMemo-cached).
• renderer/src/main.tsx: re-imports the restored vanilla CSS in dependency order (tokens → base → components → layout → animations → shell.css last for React overrides).
• renderer/css/* (restored verbatim from the pre-emrg: gui renderer Batch 5 cleanup — delete vanilla renderer + legacy vm.runInContext tests #1024 revision, verified byte-identical via git diff 2cec0cf): one pre-existing malformed rule fixed — a stray trailing } in components.css that browsers tolerated but the vite lightningcss minifier rejects.
• Agent.md: renderer test count 411 → 415 (+4 vendorMarkdown); Batch 5 description updated.

Verification

• tsc --noEmit clean; vitest415 passed (42 files); npm run build succeeds (CSS 1.9→48.3 kB — vanilla styles now bundled; JS 295→453 kB — marked/DOMPurify/hljs bundled).
• Built dist assets confirmed to contain: .msg/.tool-row/.composer-card/.dialog/hljs CSS rules, --token variables, marked/DOMPurify/hljs/highlightAuto in JS, and .react-shell overrides last.
• Full Python suite 1106 passed + 1 skipped; GUI npm test 81 pass + 8 skip; doc-count guard 4 passed; import + CLI OK.

[argszero]

✅ LGTM — cycle 2026-08-27T06:41:13

Verified this PR fixes a genuine Batch 5 regression (confirmed on master before checkout):

• main.tsx imported only ./shell.css — the vanilla css/ suite deleted by #1024 was never re-imported, so the shipped GUI had no theme tokens (var(--*) unresolved) and no chat styling
• TranscriptView fell back to the no-dep markdown renderer (escaped plain text)
• ResultPanel read window.hljs which nothing ever set (code blocks degraded)

Reviewed the full diff:

• vendorMarkdown.ts: clean UMD wiring (marked/DOMPurify default imports, hljs side-effect import setting window.hljs), follows the design construct-injection pattern; lazy window.hljs read avoids module-eval-order issues
• 4 tests assert against the degraded path (real strong tags / hljs token spans / window.hljs availability / DOMPurify XSS sanitization)
• Shell.tsx: useMemo-cached renderer passed to TranscriptView; fallback still guards
• main.tsx: correct dependency order (tokens → base → components → layout → animations → shell overrides)
• CSS restoration byte-identical to pre-#1024 (verified via git diff against the 2cec0cf blob) — only the stray-brace fix in components.css (required by lightningcss)

Local verification on this branch: vitest 415/415 (42 files), typecheck clean, build CSS 1.9→48.26 kB + JS 453 kB (vendor bundled), GUI npm test 81 pass + 8 skip, pytest 1106 passed + 1 skipped, doc-count guard exit 0. Built CSS confirmed to contain .msg/.tool-row/.composer-card/.dialog/hljs rules and var(--*) theme tokens. CI double-green (run 33018360656). No issues found.

[argszero]

✅ LGTM — cycle 2026-08-27T06:49:13

Second independent review (cycle 064113 → 064913, consecutive, no issues in between). Re-verified: head a612e67 unchanged, CI double-green (run 33018360656, test + test-windows), MERGEABLE/CLEAN. Full diff reviewed in cycle 064113 with local verification (vitest 415/415, typecheck, build CSS 1.9→48.26 kB, GUI 89, pytest 1106+1, doc-count 0); CSS restoration byte-identical to pre-#1024. No issues found.

[argszero]

✅ LGTM — cycle 2026-08-27T07:03:10

Third independent review (064113 → 064913 → 070310, consecutive, no issues in between). Re-verified: head a612e67 unchanged, CI double-green (run 33018360656), MERGEABLE/CLEAN. Full diff + local verification in prior cycles (vitest 415/415, typecheck, build CSS 48.26 kB, GUI 89, pytest 1106+1, doc-count 0). No issues found.