[docs] Require bundled parser hardening

Signed-off-by: Viwat Vchirawongkwin <viwat.v@chula.ac.th>

Author: yyods

docs/specifications/website.md

@@ -423,10 +423,15 @@ contract with `npm audit --audit-level=high`. The Sites adapter MUST be pinned
 to a compatible vinext release whose installed npm package dependency closure
 does not contain `image-size` 2.0.2, the package described by
 GHSA-w3rx-r6r6-pgpr and GHSA-5p2g-fcmc-qvqq; a deterministic lockfile contract
-MUST reject its reintroduction. Authored App Router source MUST continue to use
-static files in `public/` instead of filesystem metadata image routes named
+MUST reject its reintroduction. While vinext publishes the same parser inside
+its build tooling, installation MUST deterministically add fail-closed guards
+for zero-length ICNS entries and HEIF/JXL boxes, MUST fail if the reviewed
+upstream source no longer matches, and MUST retain the parser's MIT attribution
+in the generated website notice. Authored source MUST continue to use URL paths
+to static files in `public/`, with explicit dimensions where required, instead
+of static image module imports or filesystem metadata image routes named
 `favicon`, `icon`, `apple-icon`, `opengraph-image`, or `twitter-image`; the
-release gate MUST enforce that absence before either build.
+release gate MUST enforce both absences before either build.
 
 ### 6.1 Canonical production origin