fix(lint): parse inline script type and source attributes

[user-github-me]

The inline-script syntax rule currently reads type and src with regexes. Valid unquoted or mixed-case module/importmap/JSON types receive classic-JavaScript syntax errors, while data-src, data-type, or quoted metadata mentioning those attributes can suppress a real error.

Read the actual decoded attributes with the existing HTML parser and normalize the type before applying the same four exemptions. Classic scripts with metadata are checked; true external scripts and exempt types keep their existing treatment, including first-attribute semantics.

Validation:

• 15 fail-first cases; 18 total regression/control cases cover unquoted/mixed-case/encoded types, duplicate attributes, metadata, and real external attributes.
• Full lint suite: 852 passed. CLI lint/check suites: 149 passed. Lint findings remain identical for all 214 shipped compositions.
• Built CLI verifies four formerly rejected valid fixtures, three formerly missed syntax errors, and the unchanged classic control.
• Native Chromium executes the unquoted module and reads the JSON data block without errors. The module composition passes strict check, runtime/layout, and all five contrast samples.
• Parser/lint/CLI builds, lint typecheck, repository lint/format, pre-commit gates, comment checks, deletion guard, and test reachability pass.

[jrusso1020]

Verified that on main \bsrc\s*= matches data-src=, and that an unquoted type=module gets a false syntax error. Reading the real attributes through the existing decoded reader fixes both and matches how the gsap rule already detects module scripts. The tests cover the regressions and the controls, and they fail on main.

— Rames