fix(#184): escape HTML on first speculative update

[BearToCode]

Actually fix the issue mentioned by @itsmunzir and @imunisasi in #184

[itsmunzir]

Checked the helper: the escape order is right — & is replaced first, so a literal < someone typed stays < and cannot turn back into a tag.

This branch shipped broken twice (4.11.3 returned the raw text; 4.11.4 only sanitized when a sanitizer was configured), so it deserves one guard before the next release. The package has no test runner today, so the smallest check is the reporter's own repro against this branch: open an empty editor, type <img src=x onerror=alert(1)>, and confirm the overlay paints that text literally while the first highlight pass is still pending. If vitest lands here later, the one-line case is speculativeHighlightUpdate('', '<img src=x onerror=alert(1)>', '') returning <img src=x onerror=alert(1)>.

Nothing else from me on this one.

[github-actions]

🎉 This PR is included in version carta-md-v4.11.5 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀