fix(phase-3): sanitize XML attributes with html.escape and expand security test coverage

feat(phase-3): implement prompt injection defenses and security hardening