feat(builder): add shared escape/safeUrl util

Adds craft/src/utils/escape.ts as the single exported escaping/URL-safety
util (escapeHtml, escapeAttr, safeUrl) for later hardening tasks to
consolidate the 27 divergent local copies into. html-export.ts now
imports escapeHtml from it instead of keeping a private copy.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

craft/src/utils/html-export.ts

@@ -1,5 +1,6 @@
 import { componentResolver } from '../components/resolver';
 import { cssPropsToString } from './style-helpers';
+import { escapeHtml } from './escape';
 
 export interface ExportOptions {
   title?: string;
@@ -198,10 +199,6 @@ ${bodyHtml}${animationScript}
 </html>`;
 }
 
-function escapeHtml(str: string): string {
-  return str.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
-}
-
 /**
  * Export serialized Craft.js state to standalone HTML.
  */