escapeXml is unsafe for XML attributes — only escapes 5 syntactic chars, not control characters

Opus finding

escapeXml is unsafe for XML attributes — only escapes 5 syntactic chars, not control characters

• apps/web/lib/rss.ts:6-16
• apps/web/lib/rss.ts:1-5

The comment claims escapeXml 'has to handle every character that XML treats as syntactic', but XML 1.0 disallows most ASCII control characters (U+0000–U+0008, U+000B, U+000C, U+000E–U+001F) entirely — they are not legal in XML content and cannot simply be escaped via numeric entities. If a finding title, description, or selfLink contains, say, U+0000 or U+0001 (which could leak in from raw model output or repo metadata), renderRssFeed will emit a malformed XML feed that breaks every RSS reader. The escape function is documented as load-bearing but does not strip or replace illegal control chars, contradicting the comment.