fix(lint): read attribute values with the HTML parser

[user-github-me]

When a quoted title contains id="ghost", data-start="0", or data-composition-src="ghost.html", lint's regex attribute reader treats that text as real markup. This invents host/timing errors and can suppress the genuine missing-media-ID error.

Read raw and decoded values through the existing HTML parser, selecting character-reference decoding per caller. Raw reads keep entity text and the empty-as-absent contract; decoded reads retain Boolean attribute semantics. Actual values with opposite quotes or unquoted HTML values are read completely, and the first duplicate attribute wins.

Related investigation: closed/unmerged #2802 addressed this reader with unconditional decoded reads. This change keeps the raw/decoded distinction and verifies current source and callers. #4396 already fixes Boolean attribute-name detection; this fixes value reads.

Validation:

• All 849 lint tests and 77 CLI project-lint tests passed; eleven new cases fail on main.
• Lint findings are identical across 214 shipped example/block compositions.
• Built CLI now reports the missing real video ID; a title-only example passes strict lint/check, and a correct unquoted clip passes lint.
• Lint/CLI builds and typechecks, repository lint, formatting, pre-commit hooks, comment checks, deletion guard, and test reachability passed.

Valid unquoted attributes now participate in lint rules, so real violations in unquoted markup can newly be reported.

[jrusso1020]

Verified on main: the regex reader picks up attribute text inside other quoted values (for example title='id="ghost"'), and it cuts off values that contain the other quote character, so style="font-family: 'Inter'; ..." reads as font-family: . Moving readAttr onto the existing parser path fixes both and keeps the empty-as-absent contract. The new tests fail on main and pass here, the full lint suite passes, and lint time on the largest fixtures is unchanged.

— Rames