New best-practice rule proposal: elements with aria-haspopup should communicate popup state via aria-expanded

The WAI-ARIA APG patterns for popup triggers (combobox, menu button, listbox pickers) pair aria-haspopup with aria-expanded on the trigger so AT users can tell whether the popup is open. In practice, shared component libraries frequently ship the first attribute without the second: the trigger announces "has popup" but never announces state changes.

Real-world instance: Quill's toolbar pickers (slab/quill#4807 — my open PR implementing the full listbox pattern). A taxonomy-based static audit of PrimeNG's component source found the same incomplete-pairing pattern.

Proposed rule: flag elements bearing aria-haspopup (any non-false value) that have neither aria-expanded nor aria-controls referencing an element whose visibility toggles. Suggested: best-practices ruleset, serious impact — the pairing is an APG-pattern expectation rather than a hard spec MUST, so best-practice seems the right category. I'm happy to contribute the rule implementation and test fixtures if maintainers are open to it.

Review axe-core's existing best-practices rules and test fixtures, then compare the proposal with the WAI-ARIA APG popup-trigger patterns and the Quill and PrimeNG examples cited here. Done means maintainers agree on the aria-haspopup, aria-expanded, and aria-controls scope and the rule has implementation and test fixtures covering it.

Written by the indexing model from the issue text.