fix(site): strip tags to a fixpoint when extracting llms-full.txt section titles

[lsimons]

Closes the one open CodeQL alert on this repo — js/incomplete-multi-character-sanitization
in site/src/plugins/exclude-design-record-from-llms-full.mjs.

What the real defect is

Not a vulnerability, and this PR does not claim to be a security fix: the input is
the project's own build output, the code runs at build time in an
astro:build:done hook, and the extracted string is only ever used as a Set key
to match section headings — it is never re-emitted as HTML.

The genuine defect underneath is that replace(/<[^>]+>/g, '') is not
idempotent: stripping one match can create a new one out of the surrounding
text, so a heading containing markup (inline code, a <span>, an element
wrapping an emoji) can leave a partial tag behind and fail to match its
llms-full.txt section. The site's own spec pages contain exactly that kind of
heading.

Why the title is still read out of HTML

The preferred fix was to stop parsing HTML at all and read the title from Astro.
That was ruled out empirically, not assumed:

• astro:build:done's hook argument is { pages: { pathname }[], dir, assets, logger } —
  no title, no frontmatter (checked against Astro's own type definitions).
• Importing astro:content inside the hook fails both ways: statically at
  config-load time (Cannot find module 'astro:content'), and dynamically at
  hook-run time (Vite module runner has been closed) — Astro tears the module
  runner down before this hook fires.
• astro:routes:resolved's route type exposes entrypoint/pattern, not
  frontmatter.

So the built HTML is the only source available at this point, and the fix is to
make the strip idempotent: stripTagsToFixpoint() loops until the string stops
changing. No new dependency added.

The two pre-existing comment blocks recording why this plugin exists (the
upstream exclude option is not forwarded to llms-full.txt) and why
PAGE_SEPARATOR replaced a blank-line split (a guide page quoting file contents
in a fenced block produced a false page boundary) are left intact.

Verification

Real build, not logic in isolation. Built llms-full.txt/llms-small.txt with
the fix, then reverted the plugin and rebuilt with the original single-pass code,
and diffed: byte-for-byte identical output on the real corpus — 54 spec and
research pages excluded in both, 18 guide/article/get-involved pages surviving
with headings intact, PAGE_SEPARATOR fully cleaned from both files in both
cases. astro check: 0 errors. mise run ci green (unaffected — pure JS change).

The alert should auto-close once code scanning re-runs on main; no manual
dismissal, since this is a fix rather than a suppression.

Co-Authored-By: lsimons-bot bot@leosimons.com