feat(content-script): verify against pristine fetched HTML, not the DOM

[jt55401]

Summary

Fixes false-invalid verification on pages whose client-side scripts mutate content inside signed regions after page load.

The most visible case is Hugo Blox's docs theme (used by the project website itself), which injects <button class=\"copy-button\">Copy</button> into every <pre> block on DOMContentLoaded. The signer at build time never sees the button; the verifier reading element.innerHTML does; canonical text diverges; signature reports as invalid despite being mathematically correct. Documented as Known Issue: Runtime DOM Mutation in the spec README.

What changed

autoVerifyPage() now:

1. Fetches location.href with cache: 'force-cache' (browser HTTP cache hit on the typical post-navigation path)
2. Extracts every <signed-section> substring from the pristine response via extractSignedSections() (new helper landing in feat(verify): add extractSignedSections helper for pristine-HTML verify htmltrust-browser-client#1)
3. Position-pairs each pristine slice with the live DOM section by document order, passes the pristine slice (not the DOM element) to verifySignedSection()

The DOM element is still used for UI placement (badge anchor, decoration). Only the bytes fed to canonical-hash computation come from the pristine fetch.

Fallback

Falls back gracefully to per-section DOM verification when:

• pristine fetch fails (network, HTTP error, CORS)
• pristine section count ≠ DOM count (page rendered differently between navigation and our fetch, SPA route change, intercepting service worker)

The fallback re-introduces the runtime-mutation false-invalid risk on those pages, but only on those pages, and a console.warn marks the case for debugging.

Depends on

• feat(verify): add extractSignedSections helper for pristine-HTML verify htmltrust-browser-client#1 — adds extractSignedSections to the lib

(Already merged that PR locally via the file: dep, so this PR's CI will exercise the new export.)

Test plan

• npx tsc --noEmit clean
• existing 7 Jest tests still pass
• CI green on this PR
• After both PRs merge + extension rebuilds: load the spec page in the extension and confirm signature shows valid

🤖 Generated with Claude Code