Correct repository discovery metadata and safely retire stale wiki guidance

[jmanico]

Reviewed 2026-09-25 (America/Los_Angeles) against main at bd249f5. Execution order and cross-issue ownership: #169. Batch 05.

This scope replaces the dated implementation prescriptions in the original report and earlier comments; linked historical evidence remains useful but must be rechecked before implementation.

Live state and remaining work

The repository description still says Java 1.5+, topics remain defense/encoding/java/xss, and the wiki remains enabled. Historical wiki edits do not alone prove its current edit permissions; inspect the live setting before asserting public editability.

• Update description/topics to Java 8+, contextual encoding and the distinction between zero-dependency core and adapters; align with current README.
• Verify wiki permissions and restrict editing if necessary while reviewing its content. Archive unique useful material before choosing to hide the wiki; keep a recoverable record.
• Reassess legacy grave-accent advice against current browser support and Support ordinary templates and preserve JavaScript Unicode data #155's contracts before migrating it. Do not republish obsolete workarounds as current security guidance.
• After migration/link updates, make an explicit retain/hide decision and verify the public result. A custom social preview is optional, not a security or release blocker.
• Coordinate separate OWASP website changes with that repository; do not assume editing this repository changes the external project page.

#128 owns canonical usage guidance; #108 settings hardening; #96 generated-site/Pages retirement. This issue does not authorize a blind deletion of documentation.