Potential fix for code scanning alert no. 1: DOM text reinterpreted as HTML

[cbulock]

Potential fix for https://github.com/cbulock/cindor/security/code-scanning/1

To fix this without changing functionality, ensure any DOM-derived state that is later interpolated into HTML strings is encoded before insertion into innerHTML templates. In this file, reuse existing escaping for attribute contexts (escapeAttribute(...)) and add strict runtime validation for enum-like values.

Best single approach here:

1. Validate activeAlertTone at assignment time (in hydrateHomeExamples) so only allowed tones are accepted.
2. Escape dynamic strings in HTML attributes in renderDocsHome, especially:
   • value="${activeSectionId}" → value="${escapeAttribute(activeSectionId)}"
   • tone="${activeAlertTone}" → tone="${escapeAttribute(activeAlertTone)}"
3. Keep existing behavior intact (same rendering strategy and rerender flow), only hardening interpolations.

Edits are all in apps/docs/src/main.ts in the shown regions around:

• renderDocsHome(...) template interpolations.
• toneSelector and layerFilter change handlers in hydrateHomeExamples().

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[Copilot]

Pull request overview

Hardens the docs app’s innerHTML string templates against XSS by escaping DOM-derived values before interpolating them into HTML attributes, and by adding runtime allow-list validation for enum-like UI state.

Changes:

• Escapes activeSectionId before interpolating into the cindor-tabs value="..." attribute.
• Escapes activeAlertTone before interpolating into the cindor-alert tone="..." attribute.
• Adds runtime allow-list validation when assigning activeAlertTone and catalogLayer from segmented-control values.