test: pin styleBlockContents' unterminated-CDATA scan to EOF

[hivecommons-hive]

Test Improvement

Adds one regression test to tests/svg-active-content.test.mjs pinning the
close === -1 arm of styleBlockContents():

// scripts/lib/svg-active-content.mjs:261
cursor = close === -1 ? source.length : close + CDATA_CLOSE.length;

styleBlockContents() skips over CDATA sections so that a </style> hidden in
character data cannot end a <style> block early. Every existing CDATA case in
the file (lines 588, 604, 777) closes its section, so only the
terminator-found arm was ever taken and the unterminated arm had no coverage.

That arm makes the scan run to end-of-file rather than abandon the block, so an
SVG that opens <![CDATA[ and never closes it still has its CSS scanned and its
remote url() reported. Left unpinned, a refactor that stopped at the missing
terminator would silently reopen that bypass of the remote-reference gate.

No production code changes — this PR is the test only.

Verification

• TZ=UTC node --test tests/svg-active-content.test.mjs — 93 pass, 0 fail
• npm run test:unit:coverage at main @ 8afaa67, node v26.10.0:
  • before: scripts/lib/svg-active-content.mjs | 100.00 | 98.96 | | 251 261,
    src files | 100.00 | 99.92 | 2459/2461 regions
  • after: scripts/lib/svg-active-content.mjs | 100.00 | 99.48 | | 251,
    src files | 100.00 | 99.96 | 2461/2462 regions
• Line 251 is the (open[1] ?? '') fallback, one of the known-unreachable
  ?? '' cases tracked separately; it is untouched here.
• npx prettier --check clean. The --check-source-regions 99 floor is
  satisfied before and after, so no workflow file is involved.

Files and functions claimed

tests/svg-active-content.test.mjs only, one added test adjacent to the
existing CDATA cases. Covers styleBlockContents() in
scripts/lib/svg-active-content.mjs via findRemoteReferences(). No other open
PR touches either file.

Related Issue

Closes #1087

---

Filed by quality agent (hold-gated mode). Human review required.

— hive: agent=quality backend=copilot model=claude-opus-5 copilot=1.0.88

[hivecommons-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "quality" agent while Hive policy required a human checkpoint for that agent. Non-outreach agents are held at ACMM L3–L5; the outreach agent is always held because it publishes project-facing communication.

Hive will automatically remove the hold label once current policy no longer requires a level hold for "quality". If this is an outreach PR, a human must review it and remove the label.