feat(sources): rss provider phase 2/4 — sanitation ladder, HTML→Markdown, parsing, Arrow schemas, TTL cache

Content chain of the RSS/Atom provider (plan Tasks 5-10):
- byte-level sanitation ladder: encoding repair (incl. a lying declaration
  over valid UTF-8), control-char stripping, internal-DTD refusal run on
  BOTH raw and sanitized bytes (case-insensitive)
- HTML→Markdown via htmd behind a lexical MAX_HTML_DEPTH=100 pre-scan —
  htmd's DOM walk recurses unboundedly and a ~7KB feed with 600 nested
  divs aborts the process on a 2MiB Tokio stack; above the ceiling the
  content degrades to tag-stripped text
- dialect conformance (RSS 0.9x/1.0/2.0, Atom, JSON Feed) + the feed-rs
  parse driver; field extraction per the spec's Field Mapping table
- fixed Arrow schemas: items (17 cols), feeds (15 cols), surface_version
  metadata; batch builders routed through the FeedStatus domain
- per-feed TTL cache: LRU-evicted windows, health observations never
  evicted, HTTP validators bundled with the window they validate
- docs/rss/semantics.yaml ships here because a schema test pins the
  overlay against the two schemas

Part 2 of 4 stacked PRs replacing #175 (base: rss-m1-phase1).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: gracexmatin

Cargo.lock

@@ -55,6 +55,9 @@ documents = ["dep:liteparse", "dep:glob", "dep:object_store"]
 rss = [
     "dep:quick-xml",
     "reqwest/gzip",
+    "dep:encoding_rs",
+    "dep:htmd",
+    "dep:feed-rs",
 ]
 
 [dependencies]
@@ -128,6 +131,12 @@ liteparse = { version = "2.4.0", default-features = false, optional = true }
 blake3 = "1"
 # include_globs matching for the documents connector.
 glob = { version = "0.3", optional = true }
+# Label lookup + transcoding for the rss sanitation ladder's re-encode rung.
+encoding_rs = { version = "0.8", optional = true }
+# Deterministic HTML→Markdown for rss item content.
+htmd = { version = "0.5.5", optional = true }
+# RSS 0.9x/1.0/2.0, Atom, and JSON Feed parsing into one model.
+feed-rs = { version = "2.4", optional = true }
 # object-store (S3/GCS/Azure) backend for the documents connector's source `path`
 # and `image_store`. Only the `aws` scheme is wired in v1 (see blob.rs).
 object_store = { workspace = true, optional = true }