feat: $sce Strict Contextual Escaping (spec 012)

[Mgrdich]

Summary

Ships spec 012 — Strict Contextual Escaping ($sce). Removes the TODO(spec-$sce) marker left by spec 011 and delivers the full AngularJS 1.x-parity security surface in two layered forms (ESM-first primary + DI thin shims), matching architecture.md §1.

• ESM primary: createSce / sce, createSceDelegate / sceDelegate, full trustAs* / getTrusted* / parseAs* shortcuts across the 5 public contexts (html, url, resourceUrl, js, css), SCE_CONTEXTS, and the TrustedValue class hierarchy (TrustedResourceUrl extends TrustedUrl for AngularJS subtype parity).
• DI thin shims: $SceProvider / $SceDelegateProvider registered on ngModule. $sceProvider.enabled(value?) toggles strict mode at config time (default ON). $sceDelegateProvider.trustedResourceUrlList / .bannedResourceUrlList configure the resource-URL matcher with 'self', string wildcards (** / * with AngularJS [^:/?#]* parity), and RegExp entries. Block-list wins over allow-list.
• $interpolate integration: trustedContext narrowed from string → SceContext; compile-time single-binding enforcement when strict mode is active; render-time trust unwrapping via $sce.getTrusted.
• Public surface: ./sce subpath added to package.json exports and rollup.config.mjs; @sce/* path alias added to tsconfig.json, vitest.config.ts, rollup.config.mjs.

Test plan

• pnpm lint — clean
• pnpm format:check — clean
• pnpm typecheck — clean (tsc --noEmit)
• pnpm test — 1294/1294 green across 31 files (+221 tests vs. baseline 1073; 8 new test files cover ESM factory, delegate, provider, DI integration, interpolate-sce integration, resource-URL matcher; 11 tests ported from upstream sceSpecs.js)
• pnpm build — dual ESM + CJS + .d.ts generated for every subpath including new ./sce
• Regression: all prior specs (003, 007, 008, 009, 010, 011) pass unchanged
• AWOS verification: every acceptance criterion in functional-spec.md marked [x]; spec + tech-considerations Status set to Completed; roadmap Security ($sce) item ticked

Docs

• CLAUDE.md gains ./interpolate + ./sce Modules rows, two non-obvious invariants (frozen strict mode; TrustedResourceUrl subtype rule), and two "where to look" entries.
• context/product/product-definition.md § 2.1 Core Features lists Security ($sce) with both surfaces named.
• TSDoc @example blocks show the typical allow-list config and the $sce.trustAsHtml + $interpolate pairing.

🤖 Generated with Claude Code