fix(trending): decode HTML entities in scraped repo descriptions

[nankingjing]

Problem

fetchGitHubTrending() in src/trending.ts scrapes repo descriptions and
languages from the github.com/trending HTML. It strips tags with
.replace(/<[^>]+>/g, "") but never decodes HTML entities. GitHub
HTML-escapes these fields, so entities such as &, ', <,
>, " survive into TrendingRepo.description / .language,
flow verbatim into buildTrendingPrompt(), and end up rendered raw in the
generated briefings.

This is reproducible against the live page today — one of the current
trending descriptions is:

An agentic skills framework & software development methodology that works.

which should read ... framework & software ....

Fix

Add a small decodeHtmlEntities() helper and apply it after tag stripping
for both description and language. It resolves named, decimal (&#NN;)
and hex (&#xNN;) references in a single regex pass, so already-decoded
text and unknown entities pass through untouched (e.g. < correctly
stays <).

searchRepos come from the GitHub Search JSON API (already plain text), so
that path is intentionally left unchanged.

Verification (executed, not just read)

• Fetched the live trending page and ran the existing parser: confirmed a
  real description containing &.
• Unit-tested the helper against 7 inputs (the live string, mixed
  named/decimal/hex, double-escaped, unknown entity, empty) — all pass.
• prettier@3 --check with the repo .prettierrc: clean.
• tsc --noEmit with the repo tsconfig.json (strict,
  noUncheckedIndexedAccess): exit 0.
• eslint 9.39 + typescript-eslint 8.63 with the repo eslint.config.js:
  exit 0.

Minimal diff, no unrelated reformatting.

[nankingjing]

Reviewed — decodeHtmlEntities handles named/decimal/hex entities in one pass, applied to both description and language fields. Ready for review.

[nankingjing]

Re-reviewed and added a guard for out-of-range numeric entities (e.g. �) so String.fromCodePoint cannot throw and silently discard a trending repo. All other behavior is unchanged. Local tsc --noEmit, eslint src, and focused decoder tests pass; CI run is still blocked pending workflow approval.