fix: escape project name in generated HTML

[johnjheejin]

Summary

• escape the configured project name before inserting it into generated HTML
• cover all HTML-sensitive characters used in text content
• add CLI regression coverage for both project-name locations in the viewer

Root cause

CONFIG.name was interpolated directly into the generated document title and project-name element. A project name containing markup could therefore become executable HTML instead of displayed text.

User impact

Generated viewers now display project names as text, including names that contain HTML-sensitive characters, without creating injected elements or event handlers.

Latest-base update

• rebased onto upstream main at f02a53e
• preserved the current offline HTML viewer and executable-config protections while resolving conflicts

Validation

• npm ci --ignore-scripts --no-audit --no-fund
• npm test (21 tests: 20 passed, 1 skipped because symlink creation is unavailable on Windows)
• node --check quarkify.mjs
• git diff --check