Perf: inject width/height on inline images to prevent CLS

[rivassec]

What

Extends the existing plugins/img_hygiene.py plugin to inject real pixel width/height attributes on inline content images, eliminating cumulative layout shift (CLS). No new plugin, no pelicanconf.py change (img_hygiene is already registered).

Why (CLS rationale)

Inline body images had loading/decoding but no dimensions, so the browser could not reserve layout space until the image bytes arrived, shifting the text below every image. Supplying intrinsic width/height lets the browser compute the aspect ratio up front and reserve the box, which is what removes the shift. content/static/custom.css already declares main article p img { aspect-ratio: auto; height: auto; max-width: 100% }, so it was primed to honor these attributes and had no effect until they existed.

Signal / approach

Keeps the existing content_object_init signal. Rather than depending on link resolution timing, the plugin maps each <img src> back to its source file on disk and reads the dimensions with Pillow. The resolver is form-agnostic: it strips a leading {static}/{filename}/{attach} marker (the form present at content_object_init), or a scheme+host for a resolved absolute URL, or handles a document-relative ./images/... path, then maps the /images/... tail (any STATIC_PATHS dir) onto <PATH>/images/.... Because it resolves against the file on disk, it works identically whether the src is still a marker or already a resolved URL.

Verified working in both a normal local build (pelican content -o output -s pelicanconf.py, relative srcs like ./images/x.webp) and the publish build (-s publishconf.py, absolute https://rivassec.com/... srcs) - not deploy-only.

Guardrails:

• Emits plain HTML attributes (width="800" height="450"), never style="", so scripts/csp_audit.py stays green.
• Skips remote hosts and data:/blob: URIs (no local file to measure).
• Skips imgs that already carry width or height (author sizing preserved).
• Preserves existing loading/decoding behavior; degrades gracefully if Pillow is ever absent.
• Template images (header logo, author-bio avatar which already ships width="72" height="72", cover/OG meta) are untouched - they are not in article _content.

Injected dimensions (the 3 posts with inline images)

Post	Image	Dimensions
leap-second-chaos-2012	leap_second_monotonic_vs_wall_clock.webp	2000x800
teensy-efi-bruteforce-hours-late	teensy-efi-bruteforce-rig.webp	580x337
venezuela-twitter-proxy-osint	who-is-chavezcandanga-com.webp	892x738
venezuela-twitter-proxy-osint	chavezcandanga-web.webp	854x972

Spot-checked against PIL.Image.open(...).size - injected attrs match the real files.

Verification

• scripts/csp_audit.py output - OK (no inline styles introduced)
• scripts/check_image_alt.py, check_link_graph.py, check_em_dashes.py - all pass
• python3 -m unittest discover tests - 38 tests OK