fix(background): canonicalize the heropattern colour before templating

[LeadcodeDev]

Severity Low, category security. Location: crates/rustmotion/src/engine/render/background.rs:595

Impact

cfg.color is a free-form String on HeropatternConfig (crates/rustmotion-core/src/schema/background.rs:216, #[serde(default = "default_hero_color")]) with no validation anywhere — validate_animated_bg (crates/rustmotion/src/include.rs:267-273) checks only that the pattern name resolves. The template lands inside a double-quoted attribute (fill="{{color}}"), so a colour containing " closes the attribute and injects arbitrary markup into the document usvg then parses. usvg 0.46's Options::default() keeps the default ImageHrefResolver, whose string resolver I read at usvg-0.46.0/src/parser/image.rs:85-112: it calls std::fs::read(&path) on any href that path.exists() accepts — with resources_dir: None an absolute path resolves to itself — so an injected <image href="/absolute/path.png"> is decoded and painted into the frame. The impact is bounded (a scenario can already read a local image legitimately via {"type":"image","src":"/abs/path.png"}, and there is no network resolver), so this is a hardening gap rather than a privilege escalation. The quieter half is availability: any malformed splice makes Tree::from_data fail and line 601 returns, so the background silently does not render with no diagnostic at all.

Fix

XML-escape cfg.color before substitution (at minimum reject or strip ", <, &), or better, parse it with the existing rustmotion_core::engine::renderer::color4f_from_hex / paint_from_hex and re-emit a canonical #rrggbb. Set usvg::Options { image_href_resolver: ImageHrefResolver { resolve_string: Box::new(|_, _| None), .. }, .. } since a heropattern never legitimately references an external image. Replace the silent return at 601-603 with a warning naming the pattern and the colour.

Evidence the audit read

let svg_content = format!(
        r#"<svg xmlns="http://www.w3.org/2000/svg" width="{}" height="{}" viewBox="0 0 {} {}">{}</svg>"#,
        def.width, def.height, def.width, def.height,
        def.svg_paths
            .replace("{{color}}", &cfg.color)
            .replace("{{opacity}}", &cfg.opacity.to_string()),
    );

    let opt = usvg::Options::default();
    let Ok(tree) = usvg::Tree::from_data(svg_content.as_bytes(), &opt) else {
        return;
    };

Stacked on refactor/decorative-paint-path, which carries the previous finding of this workstream. GitHub shows only this finding's diff; merge in order.

Part of the September 2026 audit remediation chantier. Refs #220 (RM-45).