fix(#2873): close review findings across fences, sanitizer and docs

Isolated security review found resolveSpecRootReference's fence tracker
toggled on any delimiter, so a backtick fence could be closed by a tilde
one and an include in the gap was rewritten inside a code block. Fixed by
reusing scanFencedBlocks - the canonical engine already behind
stripFencedCode and extractFencedBlock - rather than carrying a fourth
copy of fence detection, which also closes the duplication the standards
review flagged.

sanitizeForRender now strips combining marks and zero-width characters
alongside the ANSI, control and bidi classes it already handled.

Adds the C, E and F matrix rows the spec review found missing, including
installer-level coverage that spawns the real install rather than calling
the report builder. Ships the how-to, the reference and command docs in
five locales, the changeset, the inventory and glossary entries, and
regenerates health.md for the new W028 rule.

Refs #2873

docs/INVENTORY-MANIFEST.json

@@ -381,6 +381,7 @@
       "health-diagnostic-rules/agent-install.cjs",
       "health-diagnostic-rules/config-validation.cjs",
       "health-diagnostic-rules/consistency.cjs",
+      "health-diagnostic-rules/install-surface-shadowing.cjs",
       "health-diagnostic-rules/milestone-archive-hygiene.cjs",
       "health-diagnostic-rules/phase-structure.cjs",
       "health-diagnostic-rules/roadmap-disk-consistency.cjs",
@@ -401,6 +402,7 @@
       "install-engine.cjs",
       "install-profiles.cjs",
       "install-scope.cjs",
+      "install-shadow-report.cjs",
       "installed-surface-resolver.cjs",
       "installer-migration-authoring.cjs",
       "installer-migration-report.cjs",