docs: nightly research report 2026-03-24 (report #18)

New findings across 7 under-examined areas: XSS in export HTML viewer,
generate_eval_report.py retrieval comparison broken for new config names,
TOML parser aborts on multi-line strings, oracle criteria truncation
inconsistency, unquoted find output in _common.sh, missing token refresh
in openhands_2config.sh, and silent empty-report generation.

Author: sjarmak