test: pin unescapeMdx's entity regex against the ESCAPES table

[hivecommons-hive]

Test Improvement

Adds three contract tests to tests/mdx-escape.test.mjs covering unescapeMdx() in scripts/lib/mdx-escape.mjs. No production code changes.

unescapeMdx() decodes by matching a fixed alternation of character references and looking each match up in the module-level ESCAPES Map. The alternation and the Map keys are written out separately, and nothing keeps them in step:

• a regex alternative with no Map entry makes the lookup fall through and re-emit the raw character reference, which shows through literally wherever the unescaped text is rendered as a plain text node;
• a Map entry with no regex alternative is simply never consulted.

Neither list is reachable from outside the module, and the file's existing unescapeMdx assertions (unescapeMdx(escapeMdx(source)) === source and unescapeMdx('plain & simple')) only exercise references escapeMdx() already produces — precisely the subset that is in sync by construction. So the drift is invisible to a behavioural test. These tests read the source instead, the same idiom already used by tests/adr-contract.test.mjs, tests/docs-contract.test.mjs and tests/manifest-contract.test.mjs.

Added:

• every character reference unescapeMdx matches has an ESCAPES entry
• every ESCAPES entry is reachable from the unescapeMdx regex
• unescapeMdx decodes every entry in the ESCAPES table

Verification

npm run test:unit — 1473 pass, 0 fail (2 pre-existing todo).
npm run test:unit:coverage:check — exit 0.
npx prettier --check tests/mdx-escape.test.mjs — clean.

Each test was mutation-checked against the source to confirm it is not vacuous:

mutation to scripts/lib/mdx-escape.mjs	result
add |& to the unescapeMdx regex	every character reference unescapeMdx matches has an ESCAPES entry fails
delete the ['e', 'e'] ESCAPES row	every character reference unescapeMdx matches has an ESCAPES entry fails
add an ['a', 'a'] ESCAPES row	every ESCAPES entry is reachable from the unescapeMdx regex and unescapeMdx decodes every entry in the ESCAPES table fail

The source was restored after each mutation; this PR's diff touches tests/mdx-escape.test.mjs only.

Scope

Claims tests/mdx-escape.test.mjs and the scripts/lib/mdx-escape.mjs unescapeMdx/ESCAPES cluster. Checked for overlap against every open hold-gated PR: #810 (tests/import-architecture-issue.test.mjs, tests/helpers-import-issue-sandbox.mjs), #818 (tests/svg-active-content.test.mjs), #825 (tests/collect-case-studies.test.mjs, tests/import-architectures.test.mjs, tests/validate-architecture-assets.test.mjs), and the page-contract PRs #829, #832, #834, #838, #840, #844. None touches tests/mdx-escape.test.mjs or scripts/lib/mdx-escape.mjs.

Related Issues

Closes #845

Refs #846 (needs-human: #846 deletes the unreachable ?? entity fallback in unescapeMdx(), which is production code and therefore outside this lane's PR scope — it needs a human or an ISSUES_PRS_MERGE agent to land. This PR makes the regex/table agreement that justifies that deletion machine-checked, so it should land first, but it deliberately leaves #846 open.)

---

Filed by quality agent (hold-gated mode). Human review required.

— hive: agent=quality backend=copilot model=claude-opus-5 copilot=1.0.88

[hivecommons-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "quality" agent while Hive policy required a human checkpoint for that agent. Non-outreach agents are held at ACMM L3–L5; the outreach agent is always held because it publishes project-facing communication.

Hive will automatically remove the hold label once current policy no longer requires a level hold for "quality". If this is an outreach PR, a human must review it and remove the label.