html attribute-value patterns assume double-quoted values only (single-quoted HTML never matches) #735

Found while closing #587 (strict-parsing tests for html, part of epic #518, PR #734).

The gap

Every attribute-value pattern in html's rules dict in gitgalaxy/standards/language_standards.py
is written as "[^"]*" -- double-quoted values only. This affects nearly all 39 non-None
signatures (args, safety, safety_bypasses, io, api, concurrency, ui_framework,
decorators, comprehensions, events, ssr_boundaries, telemetry, doc, ownership,
immutability_locks, test, test_skip, reflection_metaprogramming, _dependency_capture,
and more).

HTML permits either double or single quotes for attribute values (<div class='foo'> is
just as valid as <div class="foo">). Confirmed directly: none of these patterns match a
single-quoted attribute at all today.

>>> import re
>>> p = re.compile(r'\b(?:id|name)="[^"]*"', re.I)
>>> p.search("<div id='main'>")  # single-quoted -- valid HTML
None
>>> p.search('<div id="main">')  # double-quoted -- matches
<re.Match object; span=...>

Why this wasn't fixed as part of #587

Double quotes are the dominant real-world convention (enforced by most style guides, linters,
and every major formatter/framework default), so the practical undercount is real but likely
modest. More importantly, fixing it isn't a narrow, isolated regex correctness fix like the 8
boundary bugs #587 did fix -- it means touching nearly every one of html's 39 patterns
consistently (each "[^"]*" would need to become something like (?:"[^"]*"|'[^']*'), verified
individually for ReDoS safety and correctness), which is a much larger, systemic change better
suited to its own reviewable PR.

Scope for whoever picks this up

• Audit and fix all "[^"]*"-shaped patterns in html's rules dict to also accept
  single-quoted values.
• Worth checking whether css (and any other markup/template-adjacent language sharing this
  double-quote assumption, e.g. attribute-style patterns embedded in .vue/.svelte/.astro
  handling) has the same gap, since it wasn't specifically audited here -- this issue only
  confirmed the html case.
• Each fixed pattern needs the same regression discipline used elsewhere in epic Epic: Strict & exact regex test coverage for all structural signatures, per language #518: empirical
  old-vs-new verification, and a scaling-based ReDoS check for the added alternation (two
  unbounded classes now, [^"]* and [^']*, each independently bounded by its own quote
  character -- should stay safe, but verify rather than assume).

Part of epic #518's broader hardening sweep, but scoped as its own issue since it's a systemic
change rather than a per-language boundary-bug fix.