Fix quality scoring with CommonMark structural parsing

[chrisknvidia]

Summary

• Replace the hand-written Markdown scanner with markdown-it-py CommonMark token parsing.
• Remove deterministic prose-intent inference for MCP usage, temporal language, README guidance, and exclusivity claims.
• Preserve the Issue quality_score.py keyword checks match bare substrings, so some rules fire on correct content and others cannot fail #30 word-boundary fixes and existing shared XML-tag behavior.
• Normalize local Markdown targets for README and nested-reference policies, including encoded paths, queries/fragments, Windows separators, raw HTML anchors, code, images, and comments.
• Declare the parser dependency and update the third-party notice, changelog, and Tier 1 documentation.

Why

This is a follow-up to #45 and its post-merge review. The previous implementation used regexes to infer author intent and reimplemented substantial Markdown syntax. Those approaches were difficult to maintain and could produce false score changes for valid prose or Markdown.

Deterministic Tier 1 scoring now relies on unambiguous lexical boundaries and parsed structural evidence. Semantic documentation quality remains the responsibility of rubric-eval, while observed execution behavior remains a Tier 3 concern.

Validation

• Review Guru final pass: no Critical, Important, or minor findings.
• Python 3.12 full suite: 3,773 passed, 12 skipped, 4 deselected.
• Python 3.13 full suite: 3,773 passed, 12 skipped, 4 deselected.
• Representative corpus: 527 tracked skills, zero exceptions, zero pass/fail flips, and zero added findings. The only changes were removal of 31 MCP and 2 temporal false-positive deductions.
• ruff check ., changed-file formatting, uv lock --check, OSS source/archive scans, and git diff --check passed.
• Wheel and sdist build, strict Twine validation, fresh-wheel installation, and a real JSON quality report passed.
• Fern validation reported zero errors; redirect checking was skipped because the local environment was not authenticated.

One bridge test was intentionally excluded from both full-suite runs because an unrelated existing process owns port 18080. The untouched origin/main baseline reproduces the same environmental failure; the other three deselections are the repository defaults.

[rng1995]

Focused review of the CommonMark link-normalization changes found one scoring edge case; the parser/quality-score regression suite otherwise passed locally.

[chrisknvidia]

Second-pass review found two reproducible correctness issues in the broader parser change. The original URL-edge-whitespace fix is correct and its thread is resolved.