fix: escape raw HTML in markdown renderer (#169)

Prevents HTML tags from being rendered as live DOM elements in terminal
output. Overrides the marked codespan and html renderers to escape < and >
before inserting into the output HTML.

src/lib/components/Markdown.svelte

@@ -35,7 +35,12 @@
   };
 
   renderer.codespan = ({ text }) => {
-    return `<code class="hljs-inline">${text}</code>`;
+    const escaped = text.replace(/</g, "&lt;").replace(/>/g, "&gt;");
+    return `<code class="hljs-inline">${escaped}</code>`;
+  };
+
+  renderer.html = ({ text }) => {
+    return text.replace(/</g, "&lt;").replace(/>/g, "&gt;");
   };
 
   marked.setOptions({