Fix crash with crossref div and conditional visibility

[cderv]

So I have looked into #13992 with the help of Claude Code, and tested different scenarios. I believe this could fix #13992

---

Summary

Rendering fails with attempt to index a nil value when a div has both:

• A cross-reference ID (#tbl-, #fig-, #lst-)
• Conditional visibility class (.content-visible / .content-hidden)

Root Cause

The content-hidden.lua render function assumes node.node is always a Div and calls el.content. However, parsefiguredivs.lua transforms crossref divs into FloatRefTarget custom nodes, which then render to Table/Figure/etc. When the slot content is no longer a Div, calling .content crashes.

Fix

Check if the slot is still a regular Div before accessing .content. For transformed elements, return them wrapped in pandoc.Blocks().

if is_regular_node(el, "Div") then
  clearHiddenVisibleAttributes(el)
  return el.content
else
  return pandoc.Blocks({el})
end

Test Coverage

Added 8 test files covering various scenarios:

• Table, Figure, Listing (FloatRefTarget transformations)
• Plain div baseline (no transformation)
• Nested callout and tabset content

Fixes #13992

[posit-snyk-bot]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[cderv]

Note on clearHiddenVisibleAttributes() call:

Investigation using AST tracing revealed that this cleanup call is technically a no-op for Divs inside ConditionalBlocks:

1. The parse function (lines 46-47) strips visibility classes and attrs from the Div before storing it in the slot
2. By the time render runs, the Div already has empty classes/attrs
3. Verified via QUARTO_TRACE_FILTERS - Stage 19 shows inner Div with ["", [], []]

We're keeping the call as defensive programming with an explanatory comment, in case future code changes introduce attrs between parse and render. The cost is zero (no-op), but provides a safety net.

This cleanup IS still necessary for Spans/CodeBlocks handled by handleHiddenVisible(), as those don't go through the custom node parse phase.