Harden build-review HTML interpolation escaping

[coreytshaffer]

Summary

• Hardens exactly three remaining HTML interpolations in the build-review renderer:
  • finding severity in a class attribute;
  • completed decision status in a class attribute;
  • change_summary.files_changed in metric text.
• Routes all three values through the existing _escape helper.
• Adds four focused adversarial and ordinary-output regression tests.
• Keeps ordinary valid rendering unchanged.

Scope

Exactly two files changed:

• triage_core/build_review_report.py
• tests/test_build_review_report.py

No CLI, packet schema, packet generation, persistence, authorization, routing, CSS, layout, dependencies, documentation, or broader renderer refactoring is included.

Validation

• Focused: 14 passed
• Full suite: 1253 passed, 5 skipped, 1 xfailed
• git diff --check passed.
• git diff --cached --check passed.
• Staged scope contained exactly the two authorized files.
• Stash remained unchanged at ca3c620.

Trial context

This change originated as the second bounded Opus 5 coding trial. The implementation passed independent technical and boundary review. The recurring output-format observation remains part of the trial record but is not a reason to reject the code.

[netlify]

✅ Deploy Preview for poetic-quokka-0fd859 ready!

Name	Link
🔨 Latest commit	e8049b4
🔍 Latest deploy log	https://app.netlify.com/projects/poetic-quokka-0fd859/deploys/6a644cbfb3f14300085c8006
😎 Deploy Preview	https://deploy-preview-113--poetic-quokka-0fd859.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.