fix(extensions): escape 'stars' too, in the same stats string

Follow-up to the downloads escaping: `stars` is the other catalog-controlled
value joined into the same Rich-rendered stats line, and it was still raw --
verified that stars "[/red]x" raises the same MarkupError and aborts
`extension info`/`search`. Hardening one of the two adjacent values would have
left the reported defect reachable through the sibling field.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: jawwad-ali

src/specify_cli/extensions/_commands.py

@@ -803,8 +803,11 @@ def extension_search(
                     if isinstance(downloads, (int, float))
                     else f"Downloads: {_escape_markup(str(downloads))}"
                 )
-            if ext.get('stars') is not None:
-                stats.append(f"Stars: {ext['stars']}")
+            stars = ext.get('stars')
+            if stars is not None:
+                # Same untrusted-value/Rich-markup hazard as `downloads` above,
+                # in the same joined string.
+                stats.append(f"Stars: {_escape_markup(str(stars))}")
             if stats:
                 console.print(f"  [dim]{' | '.join(stats)}[/dim]")
 
@@ -995,8 +998,11 @@ def _print_extension_info(ext_info: dict, manager):
             if isinstance(downloads, (int, float))
             else f"Downloads: {_escape_markup(str(downloads))}"
         )
-    if ext_info.get('stars') is not None:
-        stats.append(f"Stars: {ext_info['stars']}")
+    stars = ext_info.get('stars')
+    if stars is not None:
+        # Same untrusted-value/Rich-markup hazard as `downloads` above, in the
+        # same joined string.
+        stats.append(f"Stars: {_escape_markup(str(stars))}")
     if stats:
         console.print(f"[bold]Statistics:[/bold] {' | '.join(stats)}")
         console.print()

tests/test_extensions.py

@@ -4058,6 +4058,20 @@ def test_info_renders_non_numeric_downloads(self, downloads):
         # Must not raise ValueError or rich.errors.MarkupError.
         _print_extension_info(ext_info, manager)
 
+    def test_info_renders_markup_bearing_stars(self):
+        """``stars`` sits in the same joined stats string as ``downloads`` and is
+        equally catalog-controlled, so it must be escaped too."""
+        from unittest.mock import MagicMock
+        from specify_cli.extensions._commands import _print_extension_info
+
+        manager = MagicMock()
+        manager.registry.is_installed.return_value = False
+        ext_info = {
+            "name": "Jira", "id": "jira", "version": "1.0.0",
+            "description": "desc", "stars": "[/red]x",
+        }
+        _print_extension_info(ext_info, manager)  # must not raise MarkupError
+
     @pytest.mark.parametrize("downloads", ["1500", "[/red]foo"])
     def test_search_survives_non_numeric_downloads(self, temp_dir, downloads):
         """`specify extension search` must not abort when a catalog entry's