refactor(skills): vendor one diagram viewer into two skills

[Lightbridge-KS]

✨ Intent: rich-document and ask-form share one Enlarge viewer — the diagram-zoom core — instead of two hand-copied enlarge() dialogs.

Merge risk:

• Door: two-way
• Blast radius: the Enlarge dialog in two skills (rich-document artifacts rendered after this change; every ask-form page)

Summary

• One source for the viewer. diagram-zoom.js / .css v0.1.0 from Lightbridge-KS/quarto-diagram-zoom (MIT) are copied unchanged into each skill (rich-document/assets/vendor/, ask-form/static/vendor/), because the packager zips skills independently. Both copies are byte-identical to that repo's main at c35c0a4; version and sha256 are recorded as Confirmed contracts in each skill's tracker.
• rich-document: enlarge() and its dialog CSS are removed. viewer.js keeps rendering and its own opener and calls DiagramZoom.enlarge after insertion (no observer, as ADR-0001 requires). Mermaid theme selectors move from .rd-dialog to .dz-dialog; --dz-* map to the --document-* tokens on body. rd_core.py embeds the vendored files before viewer.js; VIEWER_VERSION → 2026-10-10.
• ask-form: enlarge() becomes a five-line wrapper whose onClose keeps the theme-change guard (no re-render while the SVG is in the dialog). The vendored files load before rich.js under the unchanged CSP (script-src 'self'); --dz-* map to the glass tokens, and the toolbar keeps its pill buttons. The superseded "copy, no shared module" decision is marked in v2.md.
• Behaviour gained in both: wheel and trackpad-pinch zoom at the pointer, two-finger pinch and pan on touch screens, Fit, and iOS tap activation that survives WebKit's hover heuristic.
• Browser-check selectors follow the class rename (.rd-dialog/.rd-viewport → .dz-dialog/.dz-viewport); the label "Close", SVG-before-opener restore, and focus return are unchanged.

Verification

• Checked:
  • just test — all suites OK (test_rich_document.py 18 tests, test_ask_form.py 38 tests among them).
  • uv run bin/validate.py — 50 skills valid.
  • rich-document real-browser regression page (just test-rich-document-browser, Chromium): #rd-test-result PASS, 45/45, including "enlargement moves completed SVG", "keyboard zoom", "keyboard reset", "close restores SVG and focus", and the theme-colour checks inside the dialog; dialog background resolves to --document-bg in dark mode.
  • ask-form, served form with a Mermaid intro (Chromium): no CSP or console errors; Enlarge moves the SVG into the dialog; Zoom in 86% → 107%; dialog background = --base; a theme change while open leaves the diagram untouched and re-renders it after close.
  • The vendored core itself: quarto-diagram-zoom CI (Chromium, Firefox, WebKit, Pixel 7, iPhone 15 profiles) and an iOS Simulator pass (real pinch, pan, one-tap open/close).
• Not verified:
  • ask-form and rich-document on a physical touch device.
  • quarto-diagram-zoom v0.1.0 is not yet a published release; the vendored files equal its main at c35c0a4.

Open questions

• Merge before or after quarto-diagram-zoom v0.1.0 is published? After: the provenance points at a published tag. Before: the files are already identical to the release commit.