p2: fence document tags, atomic fleetctx, harden workspace

Neutralise </document and <document in page text. Counters are
atomic.Uint64. Workspace names are [A-Za-z0-9_-] and PathEscaped;
foreign workspace_id rows are dropped. Wayback closest.url must be
https://web.archive.org. archive.today snapshot_at is Memento-Datetime
or null.

internal/digest/digest.go

@@ -17,6 +17,7 @@ import (
 	"log/slog"
 	"math"
 	"net/http"
+	"regexp"
 	"strings"
 	"sync"
 	"time"
@@ -260,7 +261,7 @@ func (e *Engine) Run(ctx context.Context, cleaned, question, finalURL string) Re
 	if q == "" {
 		q = "Summarize the key facts."
 	}
-	user := fmt.Sprintf("Question: %s\n<document url=%q>\n%s\n</document>", q, finalURL, body)
+	user := fmt.Sprintf("Question: %s\n<document url=%q>\n%s\n</document>", q, finalURL, fenceDocument(body))
 	text, err := e.chat(dctx, user)
 	r.DigestMS = time.Since(start).Milliseconds()
 	if err != nil {
@@ -575,3 +576,14 @@ func min(a, b int) int {
 	}
 	return b
 }
+
+var documentTag = regexp.MustCompile(`(?i)</?document`)
+
+func fenceDocument(s string) string {
+	return documentTag.ReplaceAllStringFunc(s, func(m string) string {
+		if len(m) >= 2 && m[1] == '/' {
+			return "&lt;/document"
+		}
+		return "&lt;document"
+	})
+}