Vendor mermaid and drop the third-party CDN load

Andrew Dunnrequested to merge
design/vendor-mermaid into main

What does this MR do and why?

Design principle 7 forbids a third-party CDN, because Public Sector ships into controlled-egress environments where such a host is unreachable. Four places in this repo reached cdn.jsdelivr.net: the showcase and the airgap example loaded mermaid live, and the showcase's Quick start snippet, the lab template page's <head> listing, and design/js/mermaid-init.js's usage comment each taught a consumer to do the same. mermaid 11.17.2 is now vendored under design/vendor/mermaid/ and every one of those four points at a project-local copy.

Worth a reviewer's attention: standards/design's negative assertion never saw two of the four. check_grep_absent excludes */templates/* as an unanchored path segment (_lib.sh:489), which is meant for the top-level consumer scaffolds but also covers site/src/pages/templates/lab.astro, a published page. Anchoring that exclusion affects every consumer's conformance, so it is a separate MR rather than a rider here.

References

Follows the vendoring pattern and license discipline set for Phosphor in v2.3.0, documented at design/icons/README.md.

Standards affected

None. No assertion changes. The existing design/grep-absent assertion now passes on content for the files it does scan, rather than passing because the offending lines were escaped.

Exemption implications

None. No .reference.yaml exemption added or modified.

Test plan

  • just guard, just check (21 standards, 0 failed, no ADVISE) and just build && just agent green via just ship
  • design/ rendered locally: showcase and airgap example both load the vendored copy and render, eagerly and deferred inside a closed <details>, with no horizontal overflow and no request to any third-party host
  • vendor/ is absent from sync-design-assets's paths, so the published design bundle and every per-tag snapshot are byte-identical

mermaid.min.js is 3.4 MB, about nine times Phosphor's vendored footprint. It is one file, byte-identical to what both pages fetched at runtime before this change, with its version, size and sha256 recorded in design/vendor/mermaid/README.md.

Merge request reports