Separate decisions
urlPolicy controls link/navigation eligibility. imagePolicy controls browser
image requests and receives src, alt, title, nodeId, and an origin of
component or markdown. Allowing navigation never allows an image request.
External links use a trusted review dialog by default. Set
externalLinkBehavior: "direct" only when direct opening matches the host’s
security model. onNavigate can replace default opening with host routing.
Resource timing
All image modes use lazy loading, asynchronous decoding, no referrer, responsive
dimensions where available, and a failure placeholder. Progressive requests
cannot be undone, so use
committed or manual for privacy-sensitive hosts.