OCTO-11500-Harden-the-WebVTT-reader-against-malformed-input

[OlteanuRares]

Summary

• Harden WebVTT reader input validation to fix 5 real bugs: false-positive detection, BOM parse failures, NOTE/STYLE blocks with --> crashing the parser, and numeric character entities passed through as literal text
• Update check-vtt-compliance skill to reflect current code state after OCTO-11115 (inline tags) and OCTO-11116 (cue settings + STYLE blocks) — eliminates false positives from stale detection patterns
• Update 2.2.28 changelog

Changes

Bug	Before	After
detect()	"WEBVTT" in content (matches anywhere)	First-line only check
BOM files	Failed to parse	BOM stripped in detect() and read()
NOTE with -->	Crashed parser (false timing line)	in_note_block state in all 3 parse methods
STYLE with -->	Broke style parsing	Reordered condition checks
© / ♫	Passed through as literal text	html.unescape() decodes all entities

Behavioral note:   now decodes to U+00A0 (non-breaking space) per spec, not U+0020 (regular space). This is more correct but differs from prior behavior.

Test plan

• All 414 tests pass (pytest tests/ -q)
• New TestWebVTTInputValidation class covers all 5 fixes (18 test cases)
• Existing conversion tests confirm no regressions in WebVTT→DFXP/SRT/SAMI paths
• Compliance skill runs end-to-end and produces accurate report (no false positives for implemented features)
• No impact on prod (SCC input → other format outputs) — changes are reader-only

[github-actions]

🟡 PR Compliance Review

Risk Level: MEDIUM

• Compliance Issues: 3 (0 critical)
• Regressions: 0

REVIEW REQUIRED - Address issues before merging

Full report available in workflow artifacts