[gaborbernat]

bleach.linkify had no successor. nh3 declined to add one, and linkify-it-py finds links in plain text but is not HTML-aware, so projects that ran user content through bleach.linkify (comment systems, forums, markdown pipelines) have had nowhere to go since bleach reached end of life. 🔗 This adds turbohtml.linkify to serve them, closing the second half of bleach's scope after the sanitizer companion.

The new module keeps bleach's surface — linkify(text, callbacks=..., skip_tags=..., parse_email=...), a reusable Linker, and the nofollow/target_blank defaults under bleach's own names, so the common case is just an import change. Custom callbacks get a cleaner contract than bleach's tuple-keyed (attrs, new): each receives a Link with plain url, text, and attrs and returns it to keep the link or None to drop it. It is HTML-aware because it parses with turbohtml's WHATWG tree builder before linking, so it never rewrites a URL that already sits inside an <a>, a <script>/<style>, or a caller's skip_tags, which a regex over the raw string cannot guarantee. The scan for link candidates stays in C as the trigger-then-expand model the Rust linkify crate uses: it looks for the few bytes that can begin a link (:, @, .) and expands outward from each rather than backtracking a regex. A bare domain like example.com links only when its last label is a current TLD, matched against an IANA table regenerated through tox -e regen the same way the tag and entity tables are, now including the xn-- punycode entries so a real xn--p1ai matches while an invented one does not.

Two behaviors diverge from bleach, both deliberate: turbohtml leaves an existing <a> untouched instead of re-running callbacks over it, so linkifying is idempotent, and the TLD set is regenerable rather than frozen. ⚡ The C candidate scan and turbohtml's own tree carry it past bleach's html5lib pass by five to twenty times, and past linkify-it-py's pure-Python scan as well, with the figures on the performance page. Closes #9.