Make external relic links clickable

[jwaldrip]

Problem

External anchors in HTML and JSX relics could not open because rendered content runs in a script-only sandbox.

Change

• Mediate trusted reader clicks through the parent window.
• Accept only canonical absolute HTTP, HTTPS, and mailto destinations.
• Open a new tab without an opener or referrer.
• Keep the existing CSP and sandbox="allow-scripts" boundary unchanged.
• Reject scripted clicks, relative and fragment links, and executable, data, blob, or local-file schemes.
• Install click capture before inline HTML scripts or React effects can run.

Proof

• bun run verify: 1,459 tests passed, 0 failed; lint and all package typechecks passed.
• Chrome rendered an HTML relic, kept a scripted click contained, and opened the trusted external link in a new tab.
• The destination reported window.opener === null, an empty document.referrer, and no Referer request header.
• The source relic remained rendered after the external tab opened.
• A mutation that admitted javascript: made both the frame and parent regression checks fail. Restoring the allowlist returned 85 focused tests to green.