feat: add sanitize-html → neosanitize replacement

[PuruVJ]

Summary

Adds sanitize-html to the preferred manifest, with:

• neosanitize/legacy as a direct, drop-in replacement — a byte-identical port of sanitize-html 2.x (same API, same options, same output), so migration is just an import swap.
• neosanitize (root module) as the recommended alternative — a fast, browser-faithful WHATWG parser (100% html5lib tokenizer conformance) with a deny-by-default policy.

Includes a docs/modules/sanitize-html.md page with migration examples for both engines.

Migration

// Zero-change drop-in
import sanitizeHtml from 'sanitize-html'      // before
import sanitizeHtml from 'neosanitize/legacy' // after

Notes

• Placed in preferred (performance/footprint replacement — not native, not a micro-utility).
• Both replacements are represented as documented entries; the mapping points to the new e18e doc page.
• pnpm lint passes (JSON schema, sort order, doc-path checks, Prettier).

🤖 Generated with Claude Code

[changeset-bot]

⚠️ No Changeset found

Latest commit: cf3e1d1

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[PuruVJ]

Wrong target — this belongs upstream (e18e#780).