fix: resolve high-severity CodeQL findings

[AjnasNB]

What changed

• Replaces the trailing-slash regular expression with a bounded linear scan.
• Extracts site text through a single-pass tag scanner and one-pass safe entity decoder, preventing tag reconstruction and double decoding.
• Derives in-memory tab-lock verifier material with salted scrypt and zeroes temporary digest buffers. This also fixes the prior malformed hex conversion that could make different lock secrets compare as equal.
• Adds focused regression coverage for long slash runs, nested/encoded markup, wrong lock secrets, and non-disclosure of verifier fields.

Authority impact

• No authority boundary changes.
• The credential boundary is hardened: tab-lock secrets are now checked through per-lock salted scrypt verifier material, and public lock status remains limited to owner/timestamps/tab ID. No origin, approval, action, or resource ceiling is widened.

Evidence

• npm run check passes (85 tests: 80 passed, 5 browser-dependent skips; typecheck/build/package/site/audit/dry-pack all passed).
• New behavior has focused tests.
• COCKROACH_BROWSER_E2E=1 node --test .test-dist/test/browser-smoke.test.js passed with the wrong-token regression.
• Public generated text preserves encoded <hex> placeholders rather than reconstructing markup.
• No secrets, browser profiles, cookies, or generated evidence are committed.

Release impact

• No release required.
• Patch.
• Minor.
• Major.

No deployment migration is required. Existing in-memory locks are process-local and are not persisted across upgrades.

All three commits carry SSH signatures. All four open high-severity CodeQL findings are fixed; none was remotely dismissed.

[AjnasNB]

Review-ready security fix: all four high CodeQL findings are fixed without dismissals, the PR merge ref reports zero open findings, all 10 required checks pass, and every commit is GitHub-verified. The changes cover structural HTML handling, linear path scanning, and salted scrypt tab locks with regression coverage. @cognifyrdotco, please review.

[AjnasNB]

@cognifyrdotco All four reported high-severity CodeQL findings are fixed on 888ae500cac8; CodeQL and the full browser/SDK/container matrix are green. Please review the latest head so auto-merge can complete.