nx_html_extract_imgs.nx

nx_html_extract_imgs.nx -- walk a parsed HTML document, find every <img src="..."> element, resolve the src URL against a base URL, and emit absolute URLs into caller-supplied buffers. Arc B2 of NISHI_BROWSER_GOOGLE_IMAGE_SEARCH_ROADMAP. Built on top of the just-shipped Arc B1 raw-text mode so <script> bodies containing "<img" tokens-inside-strings don't pollute results. API: nx_html_extract_imgs(html, html_len, base_url, base_url_len, url_buf, url_buf_cap, offsets, lengths, max_imgs) -> count of imgs emitted (or negative error) `offsets` and `lengths` are caller-supplied parallel i64 arrays of length >= max_imgs. Each (offsets[k], lengths[k]) describes where the k-th absolute URL lives within url_buf. If url_buf fills up before max_imgs is reached, we stop emitting further URLs and return the count we did emit (truncation is substrate-honest: caller sees how many imgs they got). nx_safety_envelope: intended_use: "Image-source enumeration for the bits-up browser; feeds the image fetch + decode arc." sil_target: SIL1 evidence: [composes_b1_raw_text_mode, composes_rfc3986_url_resolver] hazard_register: [bug-tape-href-injection-bypassing-quoting, bug-tape-base-href-attack-via-page-content] residual_risk: "<base href> in document body NOT honored in this revision -- caller passes base URL explicitly. Adding <base href> support is Arc B3 once we audit its attack surface." verdict: NOT_YET_EVALUATED