Fix codespell and CodeQL findings in website components

- Fix real typos flagged by codespell: 'Couldn't' -> 'Couldn't'
  (plain apostrophe, matching convention elsewhere in JSX) and
  'Unparseable' -> 'Unparsable' in catalogFilters.ts
- DetailChassis.tsx: replace sequential HTML entity unescaping with a
  single-pass replace to avoid double-unescape/injection risk flagged
  by CodeQL
- SyntaxHighlightedCode.tsx: make the markup HTML comment regex match
  newlines so multi-line comments cannot break out of the token
  (Bad HTML filtering regexp)
- pagefindSearch.ts: strip HTML tags in a loop until stable so nested/
  malformed markup can't survive a single-pass strip (Incomplete
  multi-character sanitization)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 80686fef-efe3-4cdd-8cd6-bfa61a5d0af6

website/src/components/brand/CookbookRecipe.tsx

@@ -368,7 +368,7 @@ function RecipeFileView({
   if (status === "error" || text === undefined) {
     return (
       <Text as="p" size="200" variant="muted">
-        Couldn&apos;t load this file. <a href={githubUrl}>View it on GitHub</a>.
+        Couldn't load this file. <a href={githubUrl}>View it on GitHub</a>.
       </Text>
     );
   }

website/src/components/brand/DetailChassis.tsx

@@ -402,11 +402,20 @@ export function buildDetailToc(markdownHtml: string): {
     (match, attrs: string, inner: string) => {
       const label = inner
         .replace(/<[^>]+>/g, "")
-        .replace(/&amp;/g, "&")
-        .replace(/&lt;/g, "<")
-        .replace(/&gt;/g, ">")
-        .replace(/&quot;/g, '"')
-        .replace(/&#39;/g, "'")
+        .replace(/&lt;|&gt;|&quot;|&#39;|&amp;/g, (entity) => {
+          switch (entity) {
+            case "&lt;":
+              return "<";
+            case "&gt;":
+              return ">";
+            case "&quot;":
+              return '"';
+            case "&#39;":
+              return "'";
+            default:
+              return "&";
+          }
+        })
         .trim();
       if (!label) return match;
 

website/src/components/brand/SkillDetail.tsx

@@ -480,7 +480,7 @@ function FileView({
   if (status === "error" || text === undefined) {
     return (
       <Text as="p" size="200" variant="muted">
-        Couldn&apos;t load this file. <a href={githubUrl}>View it on GitHub</a>.
+        Couldn't load this file. <a href={githubUrl}>View it on GitHub</a>.
       </Text>
     );
   }

website/src/components/brand/SyntaxHighlightedCode.tsx

@@ -52,7 +52,7 @@ const rules: Record<CodeLanguage, readonly TokenRule[]> = {
     { kind: "punctuation", expression: /[{}[\],:]/y },
   ],
   markup: [
-    { kind: "comment", expression: /<!--.*?-->/y },
+    { kind: "comment", expression: /<!--[\s\S]*?-->/y },
     { kind: "tag", expression: /<\/?[A-Za-z][\w:-]*/y },
     { kind: "attr-name", expression: /[A-Za-z_:][\w:.-]*(?=\s*=)/y },
     { kind: "string", expression: /"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'/y },

website/src/components/brand/catalogFilters.ts

@@ -14,7 +14,7 @@ export const updatedBuckets: { label: string; max: number }[] = [
   { label: "Older", max: Number.POSITIVE_INFINITY },
 ];
 
-/** Whole days between `lastUpdated` and now. Unparseable dates sort as oldest. */
+/** Whole days between `lastUpdated` and now. Unparsable dates sort as oldest. */
 export function daysSince(lastUpdated: string | undefined): number {
   if (!lastUpdated) return Number.POSITIVE_INFINITY;
   const then = Date.parse(lastUpdated);

website/src/components/brand/pagefindSearch.ts

@@ -15,6 +15,19 @@ type PagefindResultData = {
   meta?: Record<string, string | undefined>;
 };
 
+/** Strip HTML tags, repeating until no more tags remain so a malformed or
+ * nested markup fragment (e.g. `<<script>script>`) can't survive a single pass. */
+function stripTags(html: string): string {
+  let text = html;
+  let previous: string;
+  do {
+    previous = text;
+    text = text.replace(/<[^>]*>/g, " ");
+  } while (text !== previous);
+  return text;
+}
+
+
 type PagefindModule = {
   options?: (opts: Record<string, unknown>) => Promise<void>;
   init?: () => Promise<void>;
@@ -127,7 +140,7 @@ export async function searchPagefind(
       if (!title) continue;
       items.push({
         title,
-        description: entry.excerpt?.replace(/<[^>]*>/g, "") ?? "",
+        description: entry.excerpt ? stripTags(entry.excerpt) : "",
         category: categoryOf(entry.url.split(/[?#]/)[0]),
         href: entry.url,
       });