Sanitize HTML hover rendering so workspace scripts do not execute

[rioredwards]

HTML hover previews currently render raw workspace HTML in Playwright with JavaScript enabled. Inline and external scripts can execute on hover, which is both a security problem and a source of flaky previews.

Problem

• src/hoverProvider.ts passes hovered HTML into the local renderer
• src/renderer.ts writes that HTML to disk and opens it in Playwright
• scripts are not stripped and JavaScript is enabled
• a malicious or unexpected <script> in a workspace runs during hover generation

Suggested fix

• Strip script tags before rendering, or render in a JS-disabled context
• Remove dangerous inline event handler attributes during HTML preview rendering
• Add a regression test proving a <script> does not execute during preview generation

Relevant files

• src/hoverProvider.ts
• src/renderer.ts
• src/htmlAnnotator.ts