Refresh and verify published spec artifacts

[jt55401]

Summary

• replace stale website copies with the five current IETF, W3C, and review artifacts from htmltrust-spec merge 6fb2224
• add a fail-closed sync/check script for the exact file mapping
• pin that source revision in website CI and compare all five files before building
• document the refresh and verification workflow

Validation

• all five published files match their source byte-for-byte
• no TODO-PLACEHOLDER, {DATE}, or {TBD} values remain in published drafts
• scripts/sync-spec-artifacts.sh --check --source ../htmltrust-spec
• sync/check negative-path tests
• npm run build
• actionlint .github/workflows/ci.yml
• git diff --check