build(site): [SITE-07] restore Monaco Markdown component notices

refactor/risks.json

@@ -646,11 +646,14 @@
         "scripts/site-vendor/monaco/reproduce-modes.ts",
         "refactor/baselines/monaco-basic-provenance.json",
         "refactor/baselines/monaco-basic-validation.json",
-        "refactor/changes/2026-09-15-SITE-07-monaco-basic.md"
+        "refactor/changes/2026-09-15-SITE-07-monaco-basic.md",
+        "refactor/baselines/monaco-core-origins-provenance.json",
+        "refactor/baselines/monaco-core-origins-validation.json",
+        "refactor/changes/2026-09-15-SITE-07-monaco-core-origins.md"
       ],
       "compatibleResolution": "Keep separate from owned TS migration. Verify source/version/diff and license notices before replacement; preserve API/CSS/worker URLs and run owning package tests.",
       "closureCriteria": "固定上游版本/内容差异、完整组件许可与分发 notices，兼容测试通过；仅当前上游许可证名称不足以关闭。",
-      "workspaceState": "Monaco 0.30.1 TypeScript worker identifies 4.4.4, unlike the original stale 2.7.2 notice. Fixed Git lock/recipes and four archives prove the 9698327-character adapted service segment and exact minified worker. Three original TypeScript notices plus a version/modification explanation are delivered. Unit 10/10 and three-engine editor/notice checks 6/6 pass. Other language services, shim, core embedded libraries and language definitions remain under review; VENDOR-06 is open. CSS/HTML/JSON complete workers now have exact source coverage for 119 module instances from 91 npm sources, 8 aliases, a shared Monaco-owned nls shim and three adapters; 11 archives/13 Git sources and all three minified outputs match. Four unit tests and three real-engine diagnostics/completion/formatting checks pass. Service notices, embedded attribution, mode bundles, core and basic languages remain open. Seven language-service packages now deliver nine original notices, two complete formatter source headers and attribution. JSON glob BSD terms and the HTML formatter author-year difference are preserved. Component/source/notice bindings and all 81 site notice HTTP bytes/links pass; unit 14/14 and three-engine language/mobile suites 6/6. Broader Monaco origin review remains open. All four mode bundles now reproduce exactly from 14 Monaco sources, 6 npm modules and 2 aliases (26 instances), with 6 archives/23 Git files. jsonc-parser declarations drive const enum emission; mode assets are included in license bindings. Automatic editor diagnostics/formatting/model-switch/cleanup checks pass in three engines, unit 15/15 and all three worker source regressions pass. Core/basic-language and remaining origin review remain open. All 76 basic-language bundles now reproduce byte-for-byte from 76 original grammar sources (77 module instances). The pinned repository archive verifies 156 members; 2511 unchanged upstream token cases plus 12 explicit gap cases pass in three engines with all 76 URLs loaded. Unit 16/16 and strict type/lint checks pass. Core and remaining embedded origins are still open."
+      "workspaceState": "Monaco 0.30.1 remains byte-pinned (the known CSS newline-only difference is preserved). Codicons 0.0.26 and the actual TypeScript 4.4.4 worker have original notice supplements. CSS/HTML/JSON workers, four mode bundles and all 76 basic-language bundles reproduce exactly; 2511 upstream plus 12 supplemental tokenizer cases pass in three engines. DOMPurify 2.3.1 and marked 3.0.2 now have exact npm-to-Git/source-map/development adaptations; the missing DOMPurify terms and original/legacy marked licenses are delivered. All 85 site notices and attribution links pass three-engine HTTP/mobile playback checks; Markdown formatting/filtering/hook cleanup also passes. Latest unit 18/18, strict type/lint and four-archive/seven-Git offline/network checks pass. The complete core compiler pipeline, other core/loader/localization and further embedded origins remain open; this is not an exhaustive sanitizer audit or release approval."
     },
     {
       "id": "VENDOR-07",