[SC-17911] Send logged Markdown without script tags

[even-steven]

Pull Request Description

What and why?

Fixes SC-17911 / ZD-737.

ValidMind Library text logging converted Markdown and TeX to HTML before sending it. TeX became a literal <script type="math/tex"> element in the /tracking/log_metadata request body, which Experian's Imperva WAF rejects as XSS.

When the connected backend advertises feature_flags.log_metadata_markdown, this change keeps Markdown and TeX in their original form on the wire and sends text_format: "markdown", allowing the backend to convert it after the request passes through the WAF.

Capability negotiation is centralized in alog_metadata(). If the backend does not advertise support, the library converts Markdown locally and omits text_format, preserving legacy behavior and preventing older customer-managed backends from silently storing raw Markdown. Explicit caller-supplied HTML and direct alog_metadata() calls without a format retain their existing behavior.

The WAF-safe transport covers every result path that logs descriptions through /log_metadata:

• Direct manual and AI-generated log_text() calls
• run_text_generation(...).log() results
• Default and AI-generated run_test(...).log() descriptions
• Markdown descriptions returned directly by custom tests
• Experimental generated-text results

Result objects retain rendered HTML for local notebook display and carry the corresponding raw Markdown separately for transport. If a caller later replaces the rendered description, the saved Markdown is ignored so the caller's edited content remains authoritative.

How to test

poetry run python -m unittest tests.test_api_client
poetry run python -m unittest tests.test_client
poetry run python -m unittest tests.test_test_descriptions
poetry run python -m unittest tests.test_results

Regression tests use the exact ZD-737 equation and verify both capability states:

• Supported backend: serialized requests contain raw TeX, include text_format: "markdown", and contain no <script> tag.
• Older backend: requests contain locally converted legacy HTML and omit text_format, so raw Markdown is not silently persisted.

What needs special review?

Please review the capability default of False, the centralized fallback in alog_metadata(), and the split between rendered descriptions used for local display and Markdown source used for transport.

Dependencies, breaking changes, and deployment notes

• Companion backend PR: validmind/backend#3513.
• Release order is safe in either direction. Against an older backend, this library retains legacy local conversion.
• The WAF-safe Markdown path activates automatically once the backend advertises the capability.
• Existing library versions remain compatible with the backend change.

Release notes

Fixed ValidMind Library text and test-result requests containing TeX equations being blocked by Web Application Firewalls that reject MathJax <script> tags.

Checklist

• What and why
• Screenshots or videos (Frontend) — N/A
• How to test
• What needs special review
• Dependencies, breaking changes, and deployment notes
• Labels applied
• PR linked to Shortcut
• Unit tests added (Backend) — N/A; library regression tests added
• Tested locally
• Documentation updated (if required) — N/A
• Environment variable additions/changes documented (if required) — N/A

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[cachafla]

@even-steven could you ask your agent to produce a test Jupyter notebook that we can execute and use a regression test? I'm interested in running through some example test cases for different cases of Markdown and HTML input to ensure we're not breaking any compatibility.