test: cover svg-active-content's encoding and unnamed-PI scanner branches

[hivecommons-hive]

Test Improvement

scripts/lib/svg-active-content.mjs — the SVG active-content security scanner —
held the only uncovered regions left in the whole source tree at main
900592b: src files | 2431/2435 regions | 99.84%, with all four missing
regions in this one file (lines 457 465 475 637).

All four are reachable branches on attacker-facing detection paths, not dead
code. This PR adds three tests to tests/svg-active-content.test.mjs covering
them:

1. reads the declared encoding from a single-quoted declaration — L457,
   declaredEncoding[1] ?? declaredEncoding[2]. XML_DECLARATION_ENCODING
   captures "..." in group 1 and '...' in group 2; every prior test spelled
   the declaration with double quotes, so group 2 had never fired and the
   spoofed-encoding detector had an entirely untested legal input spelling.
   The test asserts encoding='utf-16' produces the same finding and the same
   fail-closed stripActiveContent throw as the double-quoted form, and that a
   single-quoted UTF-8 still passes — so the new spelling is no more
   permissive than the old one.

2. names an empty declared encoding rather than printing a blank — L465,
   encoding || 'empty'. encoding="" is in neither SAFE_ENCODINGS nor
   SINGLE_BYTE_ASCII_ENCODING, so the finding fires with the empty label.

3. reports and removes a processing instruction with no target — L475 and
   L637, target || '(unnamed)' in findActiveContent and stripOnce.
   PROCESSING_INSTRUCTION is /<\?([^\s?>]*)[\s\S]*?\?>/g, and because the
   target class excludes whitespace both <??> and <? type="text/xsl" ?>
   match with an empty target — precisely the shape that slips past a
   filter keyed on known PI names. The test drives both inputs through
   detection and strip, asserts the <?(unnamed)?> label on each side, and
   asserts the stripped source is clean.

No production code is changed — tests only.

Verification

• TZ=UTC node --test tests/svg-active-content.test.mjs → 77 pass, 0 fail
  (node v26.10.0).
• npm run test:unit:coverage:check → exit 0, and
  scripts/lib/svg-active-content.mjs goes from 100.00 | 97.67 to
  100.00 | 100.00.
• Source regions: 2431/2435 (99.84%) → 2435/2435 (100.00%).
• npx prettier --check tests/svg-active-content.test.mjs → clean.

Scope

Touches exactly one file, tests/svg-active-content.test.mjs. Disjoint from
every open hold-gated PR: #1039 is scripts/lib/mdx-active-content.mjs +
tests/mdx-active-content.test.mjs (a different module), #1034 is the e2e
data-variant fixtures, and #1040 is the e2e coverage reporter/runner tooling.
No overlap in files, functions, or tracker cluster.

Related Issue

Closes #1041

---

Filed by quality agent (hold-gated mode). Human review required.

— hive: agent=quality backend=copilot model=claude-opus-5 copilot=1.0.88

[hivecommons-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "quality" agent while Hive policy required a human checkpoint for that agent. Non-outreach agents are held at ACMM L3–L5; the outreach agent is always held because it publishes project-facing communication.

Hive will automatically remove the hold label once current policy no longer requires a level hold for "quality". If this is an outreach PR, a human must review it and remove the label.