test: cover reachable fallback branches in svg-active-content.mjs

[hivecommons-hive]

Test Improvement

scripts/lib/svg-active-content.mjs was the lowest-region source file in the repository — 100.00% lines / 94.07% regions, while every other source file sits at 97.56% or above. Five of its nine uncovered sub-line regions are reachable, and all five sit on a security gate: the code that decides whether third-party SVG imported into the site executes script or fetches a resource from a host the upstream author chose.

This PR adds six tests to tests/svg-active-content.test.mjs. No production file is touched.

Region	Test added
L153 ?? match[3]	a single-quoted href reaches findRemoteReferences
L153 ?? match[4]	an unquoted href reaches findRemoteReferences — so <image href=https://evil.example/b.png> cannot evade the remote-reference gate unnoticed
L176 block[1] || ''	an empty <style></style> block does not break the scan that follows it
L128 truncation ternary	a remote target over 120 chars is truncated to exactly 120 with a ... suffix, so one data-bearing URL cannot flood the import/validate gate output
L232 ?? match	an unrecognized named entity survives decodeEntities intact (no false positive) — dropping it would splice neighbouring characters and could manufacture a scheme the source never contained
L232 ?? match	an unrecognized named entity does not hide a scheme that follows it

Result

scripts/lib/svg-active-content.mjs   94.07% -> 97.06% regions
src files (aggregate)                98.46% -> 98.69% regions

TZ=UTC node --test tests/svg-active-content.test.mjs → 53/53 pass. The full suite is 1422 tests, 1420 pass / 0 fail / 2 todo. npm run test:unit:coverage:check (97 / 99 / 93 / 97) exits 0. npx prettier --check clean.

Deliberately not covered

The four remaining regions — trailing ?? '' at lines 153, 194, 302 and 397 — are unreachable, not untested. ATTRIBUTE_PATTERN and CSS_URL_PATTERN always capture exactly one alternative, and an empty quoted value yields '' rather than undefined, which short-circuits ??. That is dead code of the same class already tracked in #699 and #700; no test can reach it, so none is added.

Scope

Touches only tests/svg-active-content.test.mjs, exercising findRemoteReferences, describeTarget and decodeEntities. Disjoint from #810 (tests/import-architecture-issue.test.mjs, tests/helpers-import-issue-sandbox.mjs) and from #812 (scripts/import-architecture-issue.mjs, scripts/lib/mdx-escape.mjs, tests/mdx-escape.test.mjs).

Related Issue

Closes #817

---

Filed by quality agent (hold-gated mode). Human review required.

— hive: agent=quality backend=copilot model=claude-opus-5 copilot=1.0.88

[hivecommons-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "quality" agent while Hive policy required a human checkpoint for that agent. Non-outreach agents are held at ACMM L3–L5; the outreach agent is always held because it publishes project-facing communication.

Hive will automatically remove the hold label once current policy no longer requires a level hold for "quality". If this is an outreach PR, a human must review it and remove the label.

[hivecommons-hive]

CI note (ci-maintainer): the red Reference architecture submission check on the current head is not caused by this PR's diff. The branch predates #815 (merged 2026-09-28T22:40Z), so it still carries the invalid workflow version with a job-level if: referencing env.SUBMISSION_LABEL; GitHub fails workflow validation on every push to the branch (zero jobs, no log). Default branch is clean. Rebasing/merging main into this branch clears the check; no change to this PR's files is needed.

🐝 Hive Agent: ci-maintainer | Instance: hosted-available-lke648397-260827-5n31 | SHA: unknown

— hive: agent=ci-maintainer backend=copilot model=kimi-k3 copilot=1.0.88