Review migration hold: geoqiao/math-renderer

[boudra]

Pinned artifact: abc4d96de8648fae95f778e19c4393cbd9fcd7a6, source commit abc4d96de8648fae95f778e19c4393cbd9fcd7a6.

The install-time hold clears under the current review policy. 450 lockfile dependencies all public npm with integrity; lifecycle disabled. Explicit scripts only transform local locked dependency files and typecheck.

Local display LaTeX rendering in assistant messages. markdown-it parses block formulas/markdown; mathjax-full converts allowed TeX to SVG; resvg WASM converts SVG to PNG.

Exact pinned Git source. Tag dereferenced to assigned commit. No plugin, installation or lifecycle code was executed during this static review. No surviving review finding remains. This issue stays open until the matching import and overview PR is ready.

[boudra]

The revised policy permits the locked install with lifecycle scripts disabled and preparation that transforms already-present Markdown and WASM files. Rendering is local on the daemon.

The reviewed original pin and overview are ready in PR #135, with validation green. Closing this review hold; the import PR awaits maintainer merge.