refactor(builder): use shared escaper everywhere, drop 26 local copies

Replace divergent, buggy local esc/escapeHtml helpers across 26 files with
imports from src/utils/escape (escapeHtml/escapeAttr). Attribute call sites use
escapeAttr, text-content sites use escapeHtml. Several toHtml outputs now
correctly escape & where old local escapers omitted it.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

craft/src/utils/form-relay-wiring.ts

@@ -9,8 +9,7 @@
  * HTML — see PR #47 review).
  */
 
-const esc = (s: unknown): string =>
-  String(s ?? '').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+import { escapeAttr } from './escape';
 
 export interface RelayWiring {
   /** true when a recipient is set (relay path); false = legacy formAction fallback */
@@ -34,12 +33,12 @@ export function relayFormWiring(
   fallbackAction: string | undefined,
 ): RelayWiring {
   if (!recipientEmail) {
-    return { useRelay: false, marker: '', actionAttr: esc(fallbackAction || '#'), honeypot: '' };
+    return { useRelay: false, marker: '', actionAttr: escapeAttr(fallbackAction || '#'), honeypot: '' };
   }
   const fid = 'F' + Math.random().toString(36).slice(2, 8);
   return {
     useRelay: true,
-    marker: `<!--WHP-FORM id="${fid}" recipient="${esc(recipientEmail)}" thankyou="${esc(thankYouUrl || '')}"-->`,
+    marker: `<!--WHP-FORM id="${fid}" recipient="${escapeAttr(recipientEmail)}" thankyou="${escapeAttr(thankYouUrl || '')}"-->`,
     actionAttr: `__WHP_FORM_ACTION__${fid}__`,
     honeypot: `<input type="text" name="_gotcha" tabindex="-1" autocomplete="off" style="position:absolute;left:-9999px" aria-hidden="true">`,
   };