[Product Gap] Add CSP-safe copy and agent handoff for remediation evidence

[seonghobae]

Buyer-visible problem

Users need to move Fix Prompt, Verification, and selected finding evidence into an AI coding/review workflow without fragile manual selection. PR #902 demonstrates the demand, but its inline onclick handlers conflict with the dashboard's CSP-compatible event-listener contract in PR #909 and would reintroduce inline script behavior.

A copy button alone is also insufficient for enterprise use: the product should preserve what was copied, where it came from, and whether the clipboard operation succeeded.

Product requirement

Implement a CSP-safe remediation handoff on the latest dashboard head:

• no inline onclick, onkeydown, or dynamic JavaScript string handlers;
• event delegation or explicit listeners after dialog rendering;
• copy textContent from the rendered pre, never interpolate user-controlled text into JavaScript;
• independent actions for Fix Prompt, Verification, and an optional combined evidence bundle;
• accessible labels and success/failure announcement through a live region;
• focus must remain stable and visible;
• clipboard API failure must expose a selectable fallback rather than silently losing content;
• copied bundle includes rule ID, file/line, severity/category/context, fix prompt, verification, and evidence/provenance identifiers where present;
• no raw secret value may enter clipboard output when finding redaction rules suppress it;
• optional machine-readable JSON handoff suitable for naruon/contextual-orchestrator, with schema/version and source artifact digest.

Test-first acceptance

1. Failing test proves no inline event attributes exist.
2. Hostile backticks, ${...}, HTML, Unicode controls, and multiline content are copied as inert text.
3. Clipboard success and rejection paths both produce accessible status.
4. Reopening the dialog does not accumulate duplicate listeners or timers.
5. Copy action preserves exact rendered text and never bypasses finding redaction.
6. Combined bundle passes a versioned schema and deterministic serialization test.
7. Keyboard-only and screen-reader contract tests cover every action.
8. Production statement/branch coverage and public docstrings remain 100%.

Integration order

Land or rebase after PR #909's CSP-compatible dashboard controls. Update PRD/TRD/Architecture, UI flow/UML, threat model, test strategy, traceability, and CHANGELOG. The implementation should remain standalone while exposing a modular handoff contract for naruon/contextual-orchestrator.