Safe-outputs add-comment strips < and > from markdown code blocks

[ViktorHofer]

The safe-outputs sanitizer replaces < and > with ( and ) in the posted comment body, even inside markdown code fences. This breaks XML/HTML code examples — critical for workflows that analyze MSBuild/XML-based build systems.

Example

The agent produces:

<AppendTargetFrameworkToOutputPath>false</AppendTargetFrameworkToOutputPath>

But the posted comment contains:

(AppendTargetFrameworkToOutputPath)false(/AppendTargetFrameworkToOutputPath)

Repro

ViktorHofer/msbuild-s1#4 (comment)

Workflow: MSBuild Build Failure Analyzer run

[pelikhan]

@copilot update JavaScript xml escaped to only escape known HTML elements.

[dsyme]

Yes, issue #18310 is already fixed. Both sanitize_content.cjs and sanitize_content_core.cjs apply convertXmlTags via applyToNonCodeRegions(), which explicitly skips fenced code blocks (``` and ~~~) and inline code spans. XML like <AppendTargetFrameworkToOutputPath> inside code fences will be preserved as-is.