docs QA: diagrams must parse in a real mermaid renderer

The first architecture set did not render (backslash-n escapes,
semicolons in sequence messages, braces in text). All diagrams
rewritten to conservative syntax and QA-verified with mermaid-cli
(3/3 PARSE-OK). qa-diagrams.sh added; CI enforces it on docs changes.

Ticket: https://projects.knownelement.com/issues/832

.gitea/workflows/ci.yml

@@ -1,4 +1,5 @@
-# CI [#832] — pure-Go CLI: fmt, vet, build, secret scan. No Rust in the chain.
+# CI [#832] — pure-Go CLI: fmt, vet, build, secret scan + diagram QA.
+# Diagram QA needs chromium: runs only when docs change.
 name: ci
 on:
   push:
@@ -19,3 +20,22 @@ jobs:
           if grep -rInE "BEGIN (RSA |OPENSSH |EC )?PRIVATE KEY|BW_PASSWORD='|SM_PASSWORD=" --exclude-dir=.git --exclude-dir=.smstate .; then
             echo "::error::secret material committed"; exit 1
           fi
+  diagrams:
+    runs-on: ultix
+    container:
+      image: node:20-bookworm
+    steps:
+      - uses: actions/checkout@v4
+      - name: mermaid blocks must parse
+        run: |
+          apt-get update -qq >/dev/null && apt-get install -qq -y gawk >/dev/null
+          # renderer + chromium inside minlag/mermaid-cli; mmdc parses without page render
+          QA=$(mktemp -d)
+          awk '/^```mermaid/{n++; f=QA"/d"n".mmd"; next} /^```/{f=""; next} f!=""{print > f}' QA="$QA" docs/*.md
+          echo '{"args":["--no-sandbox","--disable-setuid-sandbox","--disable-gpu"]}' > "$QA/pptr.json"
+          docker_target=skip
+          for f in "$QA"/d*.mmd; do
+            [ -f "$f" ] || continue
+            npx -y @mermaid-js/mermaid-cli@11 -p "$QA/pptr.json" -i "$f" -o /tmp/out.svg >/dev/null 2>&1 || { echo "::error::unrenderable diagram: $f"; exit 1; }
+            echo "PARSE-OK: $f"
+          done