Vendor mermaid instead of loading it from a CDN #136

The docs site renders mermaid diagrams by fetching https://unpkg.com/mermaid@11/dist/mermaid.min.js from a CDN at runtime. Two problems with that on this repo specifically:

• We ship security tooling and our own docs pull an unpinned major-version range from a third party at page load.
• Diagrams do not render offline or anywhere unpkg is blocked.

Material's own CSS is bundled. Only the library is remote.

The loader is guarded, which makes this easy. In the theme bundle:

function as(){return typeof mermaid=="undefined" ? _t("https://unpkg.com/mermaid@11/dist/mermaid.min.js") : $(void 0)}

So if mermaid is already a global by the time a diagram renders, Material skips the fetch.

What to do:

1. Vendor mermaid.min.js into docs/assets/javascripts/, pinned to an exact version rather than a range.
2. Reference it from extra_javascript in mkdocs.yml.
3. Confirm load order actually works. extra_javascript is emitted after the theme bundle, and Material's fetch is lazy, so it should, but this is the one thing worth checking rather than assuming.

Acceptance:

• Load any page with a diagram and confirm there is no request to unpkg.com in the network panel.
• All five diagrams still render: ARCHITECTURE, HERMES_AGENT_SECURITY, DEPLOYMENT, RAG_DEFENSE, AGENT_FLOW_SECURITY.
• Diagrams render with the machine offline.

Comment here to claim it and a maintainer will assign it.