fix: escape titleSlam data text

[Brad-Edwards]

Summary

Harden titleSlam word rendering by creating word spans through DOM APIs so title content cannot break out of the data-text attribute while preserving the glitch CSS contract.

Requirement UIDs

• (none — bug/refactor/maintenance run; see Traceability section below)

Related Issues

Closes #149

ADR Impact

• ADR-005
• ADR-008

Changes

• Render title word spans with ownerDocument.createElement, textContent, and dataset.text instead of raw span HTML.
• Extend template DOM typing to include className for DOM-created template nodes.
• Add regression coverage for quoted and angle-bracket title content, plus DOM assertions for optional template branches.
• Add a security changelog fragment.

Test Plan

• pnpm exec vitest tests/system/templates-options.test.ts
• pnpm lint && pnpm typecheck && pnpm test
• pre-commit run --all-files
• CI passed on PR fix: escape titleSlam data text #156

Codex pre-push review was clean. Test-quality cycle 1 found optional-branch lifecycle-only tests; those tests now assert their rendered DOM. No over-cap test-quality cycle was run by request.

Ground Control Checks

• Implementation plan posted
• Completion gate passed
• Codex review clean
• CI green
• SonarCloud quality gate OK, 0 open issues, 0 open hotspots

Traceability

• IMPLEMENTS: issue Escape titleSlam data-text attribute instead of composing raw HTML #149 <- src/system/templates/title-slam.ts
• TESTS: issue Escape titleSlam data-text attribute instead of composing raw HTML #149 <- tests/system/templates-options.test.ts

Checklist

• Changelog fragment added at changelog.d/149.security.md
• Issue Escape titleSlam data-text attribute instead of composing raw HTML #149 closed
• in-progress label removed

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
90.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud