docs(requirements): split html safety row

Add explicit northstar ring fields to html_safety requirements, split SafeHtml shell and handler-helper obligations, and update beginner guidance without changing behavior.

req: html_safety/001

req: html_safety/002

req: html_safety/003

req: html_safety/004

req: html_safety/005

REQUIREMENTS.md

@@ -758,13 +758,19 @@ what a valid business email is. [north_star]
 ## html_safety
 
 ### req: html/001
-001	Raw HTML insertion requires an explicit safe HTML type (`SafeHtml` or equivalent). Plain `String` renders as escaped text unless explicitly wrapped.
+0	001	Raw HTML insertion requires an explicit safe HTML type (`SafeHtml` or equivalent). Plain `String` renders as escaped text unless explicitly wrapped. [north_star]
 
 ### req: html/002
-002	Hemplate-rendered output may be converted to `SafeHtml` by trusted render APIs. User input is never `SafeHtml` by default. Full-page shell composition may pass already-rendered hemplate fragments through explicit `SafeHtml` fields, and already-safe fragments may be joined without downgrading to `String`; handlers should prefer slot/resource render helpers for effect payloads.
+0	002	Hemplate-rendered output may be converted to `SafeHtml` by trusted render APIs. User input is never `SafeHtml` by default. [north_star]
+
+### req: html/004
+0	004	Full-page shell composition may pass rendered hemplate fragments through explicit `SafeHtml` fields and join already-safe fragments without downgrading to `String`. [north_star]
+
+### req: html/005
+0	005	Handlers use slot/resource render helpers for effect payloads instead of raw HTML construction. [north_star]
 
 ### req: html/003
-003	Slot render commands distinguish text payloads from HTML payloads at the type level.
+0	003	Slot render commands distinguish text payloads from HTML payloads at the type level. [north_star]
 
 ---