S00-018: Bound standalone XML ingress before Stanza parsing and import

Changes: Add an isolated public transport integration with finite byte, depth, element and attribute budgets; validate complete text XML with pinned saxes before real JXT parsing/import. Add adversarial and boundary fixtures, terminal cleanup tests, dependency notices and a proposed parser ADR.
Validation: Fresh-cache npm ci and npm test passed all 55 tests with Node 24.21.0/npm 11.19.0. Reproduced three stock parser failures, checked ten exact dependency licenses/integrities and 340 unchanged Stanza files; make check passed 72 tooling tests. Scope and whitespace inspected. Browser runtime, live WSS and interoperability were not tested.

Task: S00-018
Agent: auto-protocol-89fe6563092c
Role: protocol
Action: claim
Status: review

Task title: Validate bounded standalone XML ingress for the XMPP candidate

state/tasks.json

@@ -1,6 +1,6 @@
 {
   "schema_version": 1,
-  "revision": 43,
+  "revision": 45,
   "tasks": {
     "S00-001": {
       "status": "done",
@@ -1236,10 +1236,14 @@
       "completed_at": "2026-10-14T19:20:57+00:00"
     },
     "S00-018": {
-      "status": "todo",
-      "owner": null,
+      "status": "review",
+      "owner": "auto-protocol-89fe6563092c",
       "external_wait": false,
-      "reason": null
+      "reason": null,
+      "started_at": "2026-10-14T19:24:01+00:00",
+      "updated_at": "2026-10-14T19:31:32+00:00",
+      "evidence": "state/evidence/S00-018-auto-protocol-89fe6563092c.md",
+      "handoff": "state/handoffs/S00-018.md"
     }
   },
   "events": [
@@ -1798,6 +1802,29 @@
       "from": "in_progress",
       "to": "blocked",
       "reason": "S00-003 cannot attest parser limits: Stanza 12.22.1 exposes no resource bounds and its persistent WebSocket parser accepts large/deep XML and reassembles incomplete documents across separate input messages."
+    },
+    {
+      "revision": 44,
+      "at": "2026-10-14T19:24:01+00:00",
+      "action": "claim",
+      "task": "S00-018",
+      "agent": "auto-protocol-89fe6563092c",
+      "role": "protocol",
+      "from": "todo",
+      "to": "in_progress",
+      "reason": null
+    },
+    {
+      "revision": 45,
+      "at": "2026-10-14T19:31:32+00:00",
+      "action": "submit",
+      "task": "S00-018",
+      "agent": "auto-protocol-89fe6563092c",
+      "role": null,
+      "from": "in_progress",
+      "to": "review",
+      "reason": null,
+      "evidence": "state/evidence/S00-018-auto-protocol-89fe6563092c.md"
     }
   ],
   "retired_agents": [