fix: resolve Windows test timeout and CodeQL high-severity alerts

- Add missing vi.mock for cli-tool-manager and sentry in runner-env test
  (unmocked getToolInfo caused filesystem lookups timing out on Windows CI)
- Loop HTML tag stripping to handle nested tag fragments (CodeQL #5077)
- Decode & entity last to prevent double-unescaping (CodeQL #5076)

Co-Authored-By: Claude Opus 4.6 <[email protected]>

apps/frontend/src/main/app-updater.ts

@@ -88,16 +88,18 @@ function htmlToMarkdown(html: string): string {
   md = md.replace(/<br\s*\/?>/gi, '\n');
   md = md.replace(/<hr\s*\/?>/gi, '---\n\n');
 
-  // Remove any remaining HTML tags
-  md = md.replace(/<[^>]+>/g, '');
+  // Remove any remaining HTML tags (loop to handle nested tag fragments)
+  while (/<[^>]+>/.test(md)) {
+    md = md.replace(/<[^>]+>/g, '');
+  }
 
-  // Decode common HTML entities
-  md = md.replace(/&amp;/g, '&');
+  // Decode common HTML entities (&amp; LAST to prevent double-unescaping like &amp;lt; → &lt; → <)
   md = md.replace(/&lt;/g, '<');
   md = md.replace(/&gt;/g, '>');
   md = md.replace(/&quot;/g, '"');
   md = md.replace(/&#39;/g, "'");
   md = md.replace(/&nbsp;/g, ' ');
+  md = md.replace(/&amp;/g, '&');
 
   // Clean up excessive whitespace
   md = md.replace(/\n{3,}/g, '\n\n');

apps/frontend/src/main/ipc-handlers/github/utils/__tests__/runner-env.test.ts

@@ -30,6 +30,15 @@ vi.mock('../../utils', () => ({
   getGitHubTokenForSubprocess: () => mockGetGitHubTokenForSubprocess(),
 }));
 
+vi.mock('../../../../cli-tool-manager', () => ({
+  getToolInfo: () => ({ found: false, path: undefined, source: undefined }),
+}));
+
+vi.mock('../../../../sentry', () => ({
+  getSentryEnvForSubprocess: () => ({}),
+  safeBreadcrumb: () => {},
+}));
+
 import { getRunnerEnv } from '../runner-env';
 
 describe('getRunnerEnv', () => {