fix(security): resolve CodeQL ReDoS, Marp tag sanitization, and test runner issues

[phine-apps]

Summary

This PR addresses high-priority security alerts reported by GitHub CodeQL (Code Scanning) and fixes the VS Code integration test runner environment.

1. Fix ReDoS in structural diff regexes (js/redos)

• Footnote bundle matching: Simplified footnoteBundleRegex in src/markdown/structuralDiff.ts by eliminating nested quantifiers ((?:<li[^>]*>[\s\S]*?<\/li>\s*)+) that caused exponential backtracking on long or repeated list items. Guarded the callback to process only valid footnote list bundles without colliding with list container swaps.
• Heading prefix matching: Rewrote wrapHeadingPrefixes in src/markdown/structuralDiff.ts to use a linear heading matcher and deterministic prefix parser instead of backtracking nested whitespace/quantifier groups.

2. Improve Marp script & style sanitization (js/bad-tag-filter, js/incomplete-multi-character-sanitization)

• Marp tag extraction and cleaning: Updated cleanMarpHtml in src/markdown/marpRenderer.ts to use case-insensitive matching with whitespace tolerance (/<\s*script\b[^>]*>([\s\S]*?)<\/\s*script\s*>/gi) to avoid tag bypasses (e.g. </script >, multiline attributes, uppercase tags). Applied iterative loop stripping (do ... while) for complete tag removal.
• Unit test script regex: Updated script matching pattern in src/test/unit/markdownDiff.test.ts to match case-insensitively with full attribute/whitespace tolerance.

3. Fix VS Code integration test runner (src/test/runTest.ts)

• Removed inherited ELECTRON_RUN_AS_NODE from process.env before calling runTests so VS Code launches properly as a GUI Electron app with extension CLI arguments when executed from VS Code integrated terminals or IDE sub-shells.

---

Verification

• Unit Tests: 233 passing (3s) (pnpm test:unit)
• Integration Tests: 50 passing (3s) (npm run test)
• Visual Regression Tests: Passed via Docker (pnpm run test:visual:docker)
• Compile & Lint: 0 errors