Left: element.innerHTML = marked(text). Right: renderer.renderMarkdownInto(element, text).
Query parameters: ?mode=naive|policy|both, ?policy=strict|balanced|permissive.
Under Trusted Types enforcement: trusted-types.html (CSP in a meta tag) or
?csp=1 when served by e2e/run.mjs.