fix(review): escape fix handoff paths

[JSONbored]

Motivation

• The Fix handoff renderer interpolated finding.path directly into an inline-code markdown span, which allowed adversarial paths containing backticks, pipes, brackets, or markdown link syntax to inject rendered markdown into the public unified review comment.

Description

• Add a path-specific escaping helper markdownPathCodeText in src/review/fix-handoff-render.ts that neutralizes backslashes, backticks, pipe characters, and angle brackets before composing the inline-code location label.
• Use the escaped path (safePath) when building the location string in buildFixHandoffBlock so the rendered body contains a markdown-safe inline-code span.
• Add a regression unit test in test/unit/fix-handoff-collapsible.test.ts that supplies an adversarial path with a backtick, markdown link, pipe, and angle brackets and asserts the rendered block body contains the escaped form while the raw structured path field remains unchanged.

Testing

• Ran the focused unit tests: npm test -- --run test/unit/fix-handoff-collapsible.test.ts, all tests passed (11/11).
• Ran type checking: npm run typecheck, which succeeded with tsc --noEmit.
• Ran git diff --check, which reported no issues.
• Ran the full local gate: npm run test:ci, which did not fully complete due to environment/registry drift (the existing cf-typegen:check reported worker-configuration.d.ts stale); this is unrelated to the patch itself.
• Attempted coverage run: npm run test:coverage -- --run test/unit/fix-handoff-collapsible.test.ts, the unit tests passed but coverage tooling failed with TypeError: jsTokens is not a function in the environment.
• npm audit --audit-level=moderate failed due to a registry/network 403 Forbidden from the audit endpoint in this environment; not related to the change.

Files changed: src/review/fix-handoff-render.ts, test/unit/fix-handoff-collapsible.test.ts.

---

Codex Task

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.63%. Comparing base (9ba80b6) to head (5ffb98c).
⚠️ Report is 3 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4082   +/-   ##
=======================================
  Coverage   93.63%   93.63%           
=======================================
  Files         384      384           
  Lines       35822    35825    +3     
  Branches    13146    13146           
=======================================
+ Hits        33543    33546    +3     
  Misses       1618     1618           
  Partials      661      661           

Files with missing lines	Coverage Δ
src/review/fix-handoff-render.ts	100.00% <100.00%> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Important

🟪🟪🟪🟪🟪🟪🟪🟪🟪🟪🟪🟪

🔍 Gittensory is reviewing…

AI analysis is in progress. This comment will update when the review is complete.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed · 🟪 Reviewing}