🚧 Draft — red commit only. Tests added are expected to FAIL; fix lands
in next commit.
Follow-up to #1537 — security sweep found 3 additional stored XSS sinks
of the same class.
Once the green commit lands and CI is green, this body will be replaced.
---------
Co-authored-by: CoreScope Bot <bot@meshcore>
Co-authored-by: Kpa-clawbot <bot@kpa-clawbot.local>
Co-authored-by: openclaw-bot <bot@openclaw.local>
