LHTML01 follow-up fixture

The user controls only ?bio=. Page source and deployment are fixed. Three inputs:

• direct breakout attempt — blocked by the app serializer (inert with Analytics off AND on)
• self-closing <svg/> payload — inert with Analytics off, executes with Analytics on
• paired <svg></svg> control — inert in both states

Inert marker: window.__lh=1.