Two OASIS catalog gaps from the audit:
- systemSuffix and uriSuffix entries: an identifier ending in the rule's
suffix maps to its URI, longest suffix winning, tried after exact and
rewrite matches.
- prefer=public|system on the catalog: a system match always wins, and
the public identifier is consulted as a fallback only when prefer is
public or no system identifier was given (the OASIS rule). The default
stays prefer=public.
xml:base / RFC 3986 relative-URI resolution of entry URIs and the legacy
SGML catalog format remain.
Part of #86