fix(safeoutputs): render applyable PR suggestions correctly

[Copilot]

Summary

add-pr-comment was creating inline suggestion threads that Azure DevOps treated as zero-width insertion points, and shared sanitization was escaping </> inside markdown code. The result was non-applyable suggestions and HTML entities being written back into suggested code.

• Thread anchoring

  • add-pr-comment now anchors inline threads to the full selected line range instead of offset: 1 → offset: 1.
  • The end offset is computed from the last target line’s UTF-16 length, matching ADO’s thread API semantics for single-line and multi-line suggestions.

• Markdown-aware sanitization

  • Shared HTML escaping now skips matched inline code spans and fenced code blocks, including ```suggestion bodies.
  • Escaping still applies outside code spans/fences, and unmatched backticks do not disable escaping.

• Focused coverage

  • Added unit coverage for UTF-16 end-offset calculation, multiline thread spans, fenced suggestion blocks, inline code spans, and unmatched-backtick behavior.

"rightFileStart": { "line": start_line, "offset": 1 },
"rightFileEnd": { "line": end_line, "offset": target_line.encode_utf16().count() as i32 + 1 }

Test plan

Covered by focused unit tests for:

• inline thread end-offset computation
• multiline thread anchoring
• fenced suggestion preservation
• inline code preservation
• unmatched-backtick safety