Keep quoted code and diffs exact inside cards

[MagMueller]

What changes

Restore protected card HTML with a replacement callback, so JavaScript treats the
saved code, source quote or diff as literal text.

Previously $$ became $, $& inserted the placeholder itself, and the prefix
and suffix replacement tokens could duplicate surrounding HTML. This could make
an original source or patch shown inside an Agency card differ from its artifact.

The fix changes one restoration expression. It preserves the existing reverse
restoration order and authored-prose normalization.

Validation

• The new regression failed on the previous implementation, showing all four
  replacement-token corruptions in an ordinary protected code block.
• It passes on this head for code, diffs, quotes, CSS, nested source evidence,
  stored card context and repeated normalization.
• Clean private-repository checkout: build and all 75 tests pass.
• Independent diff review found no actionable issue.

Limits

No schema, dependency, sorting, scoring, approval or status change. This prevents
future corruption; it does not reconstruct previously corrupted stored content.
Synthetic fixtures only. No private card content or customer data is included.

---

Summary by cubic

Fixes corruption of protected card content during dash normalization so saved code, diffs, and quotes restore as literal text.

Previously $$, $&, $``, and $'` in protected blocks were interpreted as replacement patterns, altering the original source or patch shown in cards. Restoration now uses a replacement callback, preserving saved content exactly.

^{Written for commit 1520ec4. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 2 files

_{Re-trigger cubic}