test(svg-active-content): cover single-quoted and unquoted attribute values

[hivecommons-hive]

Test Improvement

Adds quoting-variant cases to tests/svg-active-content.test.mjs for findActiveContent and stripActiveContent in scripts/lib/svg-active-content.mjs. No production code changes.

ATTRIBUTE_PATTERN accepts three value forms that browsers treat identically — double-quoted, single-quoted and unquoted — and both consumers read the value through a fallback chain: match[2] ?? match[3] ?? match[4] (line 175) and dq ?? sq ?? uq (line 270). All 23 existing cases wrote double-quoted markup, so only the first alternative of either chain ever ran. A regression that dropped an alternative from the pattern, or read the wrong capture group, would have left the suite green while onclick='alert(1)', href=javascript:alert(1) and srcdoc=payload passed the sanitizer unseen.

The sanitizer is correct today — these are regression locks on a security boundary, not a bug fix.

Eight new cases, generated over the single-quoted/unquoted pair:

case	asserts
event handler attribute (onclick)	detected, stripped, stripped output re-checks inert
script URI (href=javascript:)	detected, stripped, stripped output re-checks inert
embedded document attribute (srcdoc)	detected, stripped, stripped output re-checks inert
inert value (fill, width)	no finding, source returned byte-identical

Coverage

Raw V8 coverage merged with tests/tools/coverage-report.mjs semantics, measured before and after on this branch:

measure	before	after
scripts/lib/svg-active-content.mjs regions	93.18%	97.73%
src files regions	97.95%	98.20%

Four of the six uncovered sub-line regions close. The two remaining ?? '' tails are unreachable: the regex cannot match with all three capture groups undefined, so they are defensive only and no test can reach them.

npm run test:unit:coverage:check passes (fail 0); npx prettier --check tests/svg-active-content.test.mjs is clean.

Disjoint from the open queue

Touches one file, tests/svg-active-content.test.mjs. #676 touches scripts/lib/mdx-active-content.mjs and tests/mdx-active-content.test.mjs; #678 touches tests/helpers-import-sandbox.mjs and tests/import-architectures-fallbacks.test.mjs; #674 touches package.json. No overlap in files, functions or tracker cluster.

Related Issue

Closes #679

---

Filed by quality agent (hold-gated mode). Human review required.

— hive: agent=quality backend=copilot model=claude-opus-5 copilot=1.0.88

[hivecommons-hive]

Important

Held for human review by the hive's ACMM level gate.

This PR was opened by the "quality" agent while Hive policy required a human checkpoint for that agent. Non-outreach agents are held at ACMM L3–L5; the outreach agent is always held because it publishes project-facing communication.

Hive will automatically remove the hold label once current policy no longer requires a level hold for "quality". If this is an outreach PR, a human must review it and remove the label.

[mrbobbytables]

Superseded by #750, which consolidates this and 14 other test-only coverage PRs into a single reviewable change (commit cherry-picked unmodified, authorship and DCO preserved).