fix(editor): handle --!> when stripping XML comment markers

[linusdevx]

What

One-line fix to the XML toggle-comment command so it strips both --> and --!> from the end of commented lines.

-        const stripped = line.replace(/^(\s*)<!--\s?/, '$1').replace(/\s?-->(\s*)$/, '$1');
+        const stripped = line.replace(/^(\s*)<!--\s?/, '$1').replace(/\s?--!?>(\s*)$/, '$1');

Why

CodeQL alert #1 (js/bad-tag-filter, security-severity: high) flagged this regex as a bad-HTML-filtering pattern. After triage:

• The flag is technically a false positive in this context — the regex output is fed into Monaco's text buffer via editor.executeEdits(), never innerHTML'd or otherwise rendered as HTML. There's no XSS or sanitization-bypass risk; the user is editing their own document.
• But the underlying incompleteness is real. Per the HTML spec, comments can legally end with --!> as well as --> (see Comment end bang state). Without the fix, toggling-off a comment that used the bang form would leave a dangling --!> on the line.

Fixing the regex is one character (!?) and a better story than dismissing the alert.

Verification

• npm run build passes locally (Vite 6.4.3, 121ms)
• E2E tests will run on this PR
• The CodeQL re-scan triggered by this PR should auto-close alert XPATH Changes #1