Every file renderer survives hostile input: a fuzz test proves no tag escapes and none throws #11020

Renderers in src/web/render draw files strangers push; one unescaped field is stored XSS on a public repository. test/fuzz-parsers.test.ts covers parsers, not the renderers.

Done when:

• [x] New test/fuzz-renderers.test.ts uses test/helpers/fuzz.ts to feed each text renderer (csv/tsv/jsonl, log/ansi, ics, vcf, gpx, geojson, subtitles, patch, notebook, gcode, config, markdown) a few hundred seeded inputs mixing valid files with <script>, "><img onerror=, javascript: URLs, NUL, lone surrogates and very long lines.
• [x] For every input: the renderer returns (no throw), and the output contains no raw <script, no on[a-z]+= attribute, and no href/src starting javascript:.
• [x] A failing seed is printed so it can be pinned in test/fuzz-found.test.ts; any renderer bug found is fixed in the same pull.
• [x] The file runs under 2 s and joins the gate the way new tests do today.

Files: test/fuzz-renderers.test.ts (new); a renderer under src/web/render only if the fuzz finds a hole. Risk: renderers take different call shapes; read src/web/render/renderers.ts for the table.

Reviewed pull #11025 at its head: ticked New test/fuzz-renderers.test.ts uses test/helpers/fuzz.ts to feed each text renderer (csv/tsv/jsonl, log/ansi, ics, vcf, gpx, geojson, subtitles, patch, notebook, gcode, config, markdown) a few hundred seeded inputs mixing valid files with <script>, "><img onerror=, javascript: URLs, NUL, lone surrogates and very long lines.; For every input: the renderer returns (no throw), and the output contains no raw <script, no on[a-z]+= attribute, and no href/src starting javascript:.; A failing seed is printed so it can be pinned in test/fuzz-found.test.ts; any renderer bug found is fixed in the same pull.; The file runs under 2 s and joins the gate the way new tests do today..