Keep an image's alternative text and intrinsic size in attachment content

[jeremy]

Consumer action: none. This widens what an allowed element may carry; it
never admits an element.

An <img> inside a custom attachment is sanitized by Lexxy every time the
attachment renders in the editor, so what it may carry is Lexxy's decision rather
than the host app's. alt and width/height were all being dropped. alt is
what a screen reader reads; width/height are what stop the line reflowing
while the image loads. None of the three can execute anything.

alt goes in the blanket list, since it is inert on every element it can appear
on. srcset deliberately stays out — it carries URLs, so it belongs to a consumer
that declares it.

width/height are scoped to img instead, via a new per-tag mechanism, because
ALLOWED_ATTR is not per-tag: putting them in the blanket list would also permit
<table width="100000"> and <td height="500"> in attachment content, which is
layout the editor previously stripped. The widening only ever applies to tags the
caller already permits.

Verification

Both sides of the round trip, because neither catches the other:

• test/actiontext/image_attributes_test.rb reads Lexxy's allowlist out of
  source rather than copying it, so widening one side without the other fails
  there.
• test/system/attachment_content_images_test.rb drives the dummy app end to end
  — editor DOM, submitted value, rendered page, re-edited document. That needed
  the dummy mention partial to carry an avatar, since the consumer shape this
  exists for does; a data: URI keeps it self-contained and off the network.
• The unit tests are mutation-checked: revert the config change and the alt/size
  and the tag-scoping cases fail.

The tag helper test now asserts the mention's parts rather than the partial's
exact markup, so adding an avatar doesn't make it brittle.

---

Part of a series re-filing #1227 at reviewable scope, after #1227 was reverted
from main in 8c64aa4. Merge order: #1228 → #1229 → this → #instance →
#trusted-types → #1226. Nothing here is released.

Draft: needs human review and a soak period before merging.

[Copilot]

Pull request overview

Preserves image alternative text and intrinsic dimensions through attachment sanitization and Action Text round trips.

Changes:

• Allows alt globally and width/height specifically on permitted <img> elements.
• Adds unit, Action Text, and system coverage.
• Adds an avatar to the dummy mention attachment fixture.

Tip

If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/config/dom_purify.js	Extends sanitized image attributes.
test/javascript/unit/dom_purify_image_attributes.test.js	Tests attribute preservation and scoping.
test/actiontext/image_attributes_test.rb	Checks server-side attribute preservation.
test/system/attachment_content_images_test.rb	Tests the complete persistence round trip.
test/dummy/app/views/people/_person.html.erb	Adds the test avatar markup.
test/helpers/lexxy/tag_helper_test.rb	Makes mention assertions structure-based.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[jeremy]

Verification

• Unit, mutation-checked: revert the config change and the alt/size case and the tag-scoping case both fail. The other three keep passing, which is the point — they are the controls that stop this from being a blanket widening.
• Rails, both CI legs green, including the new test/actiontext/image_attributes_test.rb (3 runs, 16 assertions) and the new system test.
• bc3: 73 system tests and 132 rich-text/mention/attachment tests, 0 failures, against a build carrying this change.

Nothing here needed a browser beyond what CI already runs — the widening is decided entirely by buildConfig, and the Action Text test reads the allowlist out of source so the two sides can't drift apart silently.

CI: green (9/9).

[jeremy]

Handoff note for the whole campaign, including QA results and what still needs a human decision: #1234