✅ Add ReDoS regression tests

[stoe]

Summary

Adds regression tests for the ReDoS fixes in #8. src/validate/micro-templates.js had no test file before this change.

Changes

• Add test/validate/micro-templates.test.js covering link detection, XML tag detection, trailing whitespace, non-string input, and adversarial timing
• Extend test/core/frontmatter.test.js with CRLF frontmatter, colons inside values, continuation lines, and a long space run
• Suite grows from 19 tests in 8 suites to 39 tests in 14 suites

Affected area

Tests.

Checklist

• npm run format passes with no unstaged diffs.
• npm test passes with no new errors.
• Tests cover new or changed behavior.
• README.md is updated when CLI options, validation rules, or package exports change. Not applicable; no user-facing behavior changes.
• package.json exports and files are updated when modules are added, moved, or removed. Not applicable; tests are not published.

Security checklist

• No secrets, tokens, credentials, or personal local file paths were added to source, tests, or docs.
• Source uses only Node.js built-in modules or already-declared dependencies.
• New filesystem writes stay inside the caller-approved base directory. These tests do not touch the filesystem.
• Skill content read by the CLI is treated as untrusted data, never as instructions.
• npm audit --audit-level=high reports no new high or critical findings.

Verification

Each new test was run against the pre-fix code to confirm it genuinely fails without #8:

Test	Result against old code
Repeated opening brackets	fails, 2361 ms
Repeated tag openings	fails, 1161 ms
Repeated tabs	fails, 2598 ms
Non-string input	fails, (text || "").replace is not a function
CRLF frontmatter	fails, returns null

The timing budget is 1000 ms against a post-fix runtime under 1 ms, so a loaded CI runner will not make these flaky.

The frontmatter long-space-run case passes against old code too, because that path was never reachable. It is asserted for correctness only, not as a timing guard, to avoid implying a regression it cannot catch.

• npm test reports 39 passing tests across 14 suites, 0 failures
• npx prettier --config-precedence prefer-file --check . reports no drift

Stack

Part of a stacked PR series fixing the polynomial ReDoS code scanning alerts (bottom to top):

1. 🔒 Fix polynomial ReDoS in validation regexes #8 — 🔒 Fix polynomial ReDoS in validation regexes (stoe/fix-redos-patterns)
2. ✅ Add ReDoS regression tests #9 — ✅ Add ReDoS regression tests (stoe/add-redos-tests)