Stage 7 click-testing fixes

- aggregate: switch to shortcode syntax [aggregate ...]; fix paragraph
  wrapping by excising the shortcode and its surrounding <p> before
  sanitize, concatenating collection output outside sanitized content
- page.rb: remove aggregate XML unwrapping from rewrite_links_in_body
  (no longer needed with shortcode approach)
- rss builders: explicit CGI.escapeHTML on title/abstract; Builder 3.3.0
  does not escape when target buffer is html_safe (ActionView default)
- tinymce: disable menubar and promotion nag; add code plugin, remove
  paste plugin (built into TinyMCE 8 core); configure via admin_interface.js
  directly (config/tinymce.yml affects tinymce() helper only, not tinymce.init)

1 files changed, 2 insertions, 1 deletions

diff --git a/config/tinymce.yml b/config/tinymce.yml
index a97fbe7..c5329cd 100644
--- a/config/tinymce.yml
+++ b/config/tinymce.yml
@@ -1,7 +1,8 @@
 license_key: gpl
+promotion: false
+menubar: false
 plugins:
   - paste
 toolbar: bold italic underline | bullist numlist | link unlink | blocks | code
-extended_valid_elements: "aggregate[tags|limit|order_by|order_direction|partial|conditions]"
 relative_urls: false
 entity_encoding: raw