[Bikebrainz]

The reflected-XSS context gate treated custom names such as script-custom as raw-text elements, missed abruptly closed comments, and treated iframe fallback text as normal element content.

It now recognizes raw-text elements by exact HTML tag names, includes iframe fallback text, and handles the two abrupt comment endings. Native, browser and public-API regression cases cover these changes.

The website changelog and roadmap are updated. The roadmap moves this probe from present to partial because separate browser comparisons confirm that inert template content and some SVG contexts still differ from the reduced parser.

Validation:

• Reproduced 68 mismatches in 97 browser comparisons; the fix resolves 66. The remaining template and SVG cases are documented follow-up work.
• All 285 native assertions and 95 focused Chromium 151 browser comparisons pass.
• Added five public-API fixtures and a browser CI step. Complete application smoke validation is in progress.
• 81 Markdown targets, 3 integrity hashes and 117 website pages pass; roadmap generated from its source register.

This builds on #22. Cross-platform CI is required before merge.