test(17-06): phase 17 gate with one contract test per layer

- scripts/check-phase17.sh: stages go, plugins, admin, layers, docs and
  postgres across the framework, four plugin repositories, the host and
  both layers; go test -json, vitest JSON and TAP detectors, required
  layer test files, --self-test, --all with NOT RUN postgres and
  PHASE17_REQUIRE_POSTGRES
- TestRegistryDuplicateKey: a duplicate key fails Activate naming both
  plugin IDs, nothing is published
- TestSanitizeByteStable: clean editor HTML comes back byte for byte

modules/seaglass/seaglass_test.go

@@ -0,0 +1,50 @@
+package seaglass_test
+
+import (
+	"testing"
+
+	"git.golem15.com/golem15/summercms/modules/seaglass"
+)
+
+// TestSanitizeByteStable pins D-10's byte-stability promise: HTML the policy
+// keeps whole comes back byte for byte, with attributes in their source order,
+// entities as written, whitespace and quoting untouched, and a zero report.
+func TestSanitizeByteStable(t *testing.T) {
+	for _, html := range []string{
+		"",
+		"plain text",
+		"<p>One paragraph.</p>",
+		"<p>Mushrooms <strong>can</strong> <em>help</em>.</p>\n\n<p>Second.</p>",
+		`<a title="t" href="https://example.com/a?b=1&amp;c=2" class="x y">attributes in source order</a>`,
+		`<a class="x" href="/kontakt">relative</a> <a href="mailto:a@example.com">mail</a> <a href="tel:+48123456">tel</a>`,
+		`<p>Entities: &amp; &lt;tag&gt; &quot;q&quot; &#39;s&#39; &nbsp; &copy; &#x2014; &#8212;</p>`,
+		`<p>Raw text quotes: It's "fine" &amp; done</p>`,
+		`<p class='single-quoted'>single quotes stay</p>`,
+		`<p CLASS="upper">upper-case attribute name</p>`,
+		"<ul>\n  <li>one</li>\n  <li>two</li>\n</ul>",
+		"<ol><li>a<ol><li>nested</li></ol></li></ol>",
+		`<h2 dir="rtl">heading</h2><h3>h3</h3><blockquote><p>quote</p></blockquote>`,
+		`<p>line<br>break<br/>self-closed</p>`,
+		`<img src="/media/a.jpg" alt="An image" width="10" height="20">`,
+		`<table><thead><tr><th>h</th></tr></thead><tbody><tr><td>c</td></tr></tbody></table>`,
+		`<p style="text-align: center; color: red">styled</p>`,
+		`<div itemscope itemtype="https://schema.org/Recipe"><span itemprop="name">Tea</span></div>`,
+		`<p><sup><a href="#fn1" role="doc-noteref">1</a></sup></p><div role="doc-endnotes"><p id="fn1">note</p></div>`,
+		`<pre><code>if a &lt; b { return }</code></pre>`,
+		"<p>Zażółć gęślą jaźń — unicode “quotes”</p>",
+	} {
+		got, report := seaglass.SanitizeReport(html)
+		if got != html {
+			t.Errorf("SanitizeReport(%q) = %q, want the input byte for byte", html, got)
+		}
+		if report.Changed || report.ElementCount != 0 || report.AttributeCount != 0 || report.Comments != 0 || len(report.Elements) != 0 || len(report.Attributes) != 0 {
+			t.Errorf("SanitizeReport(%q) report = %+v, want zero", html, report)
+		}
+		if out := seaglass.Sanitize(html); out != html {
+			t.Errorf("Sanitize(%q) = %q", html, out)
+		}
+		if err := seaglass.Check(html); err != nil {
+			t.Errorf("Check(%q) = %v", html, err)
+		}
+	}
+}