fix(#2873): close review findings across fences, sanitizer and docs

Isolated security review found resolveSpecRootReference's fence tracker
toggled on any delimiter, so a backtick fence could be closed by a tilde
one and an include in the gap was rewritten inside a code block. Fixed by
reusing scanFencedBlocks - the canonical engine already behind
stripFencedCode and extractFencedBlock - rather than carrying a fourth
copy of fence detection, which also closes the duplication the standards
review flagged.

sanitizeForRender now strips combining marks and zero-width characters
alongside the ANSI, control and bidi classes it already handled.

Adds the C, E and F matrix rows the spec review found missing, including
installer-level coverage that spawns the real install rather than calling
the report builder. Ships the how-to, the reference and command docs in
five locales, the changeset, the inventory and glossary entries, and
regenerates health.md for the new W028 rule.

Refs #2873

eslint.config.mjs

@@ -159,6 +159,9 @@ export default tseslint.config(
       'gsd-core/bin/lib/health-diagnostic-rules/worktree-health.cjs',
       'gsd-core/bin/lib/health-diagnostic-rules/milestone-archive-hygiene.cjs',
       'gsd-core/bin/lib/health-diagnostic-rules/consistency.cjs',
+      // #2873 (epic #2866 Phase 4): tsc-generated runtime artifact — lint the
+      // src/health-diagnostic-rules/install-surface-shadowing.cts source.
+      'gsd-core/bin/lib/health-diagnostic-rules/install-surface-shadowing.cjs',
       'gsd-core/bin/lib/shell-command-projection.cjs',
       'gsd-core/bin/lib/security.cjs',
       'gsd-core/bin/lib/command-aliases.cjs',
@@ -200,6 +203,9 @@ export default tseslint.config(
       'gsd-core/bin/lib/runtime-artifact-layout.cjs',
       'gsd-core/bin/lib/install-scope.cjs',
       'gsd-core/bin/lib/installed-surface-resolver.cjs',
+      // #2873 (epic #2866 Phase 4): tsc-generated runtime artifact — lint the
+      // src/install-shadow-report.cts source.
+      'gsd-core/bin/lib/install-shadow-report.cjs',
       'gsd-core/bin/lib/runtime-config-adapter-registry.cjs',
       'gsd-core/bin/lib/runtime-hooks-surface.cjs',
       'gsd-core/bin/lib/command-routing-hub.cjs',