fix(data): preserve HTML entities in file writes, diffs, and commands

[0xMink]

Closes #10804

Summary

• Remove unescapeHtmlEntities() calls from WriteToFileTool, ApplyDiffTool, and ExecuteCommandTool that converted HTML entities (<, >, &, ', ") to literal characters during file writes, diff application, and command execution
• This conversion corrupted HTML/JSX/TSX content (e.g., ' becoming ' breaks JSX attributes, < becoming < breaks HTML entity display)
• Commands containing shell-significant characters were also affected — > was silently converted to > before execution
• Removed the now-redundant canonicalCommand alias per review feedback

Background

HTML entity decoding was originally added in PR #2120 (Mar 2025) as a workaround for XML-encoded tool-call payloads. When models used the XML tool protocol, special characters in tool parameters were XML-encoded (& became &, < became <, etc.), so the tool layer decoded them before execution. Over time the same decoding was applied to file writes and diff application, where it caused data corruption by mutating HTML/JSX/TSX content. The XML tool protocol has since been removed entirely — the codebase now uses native JSON tool calls exclusively, which do not XML-encode parameters. The unescapeHtmlEntities() calls are no longer needed.

Test plan

• Existing: 37 tests pass across 3 test files (executeCommandTool, executeCommandTimeout, writeToFileTool)
• Modified: HTML entity tests now assert preservation instead of conversion (executeCommandTool.spec.ts, writeToFileTool.spec.ts)
• Modified: Removed stale text-normalization mock from integration tests (executeCommandTimeout.integration.spec.ts)

[roomote]

Rooviewer   See task

All previous feedback addressed. No new issues found.

• Remove the now-redundant canonicalCommand alias in ExecuteCommandTool.ts (line 45)

Previous reviews

• ab77708: Review #1

_{Mention @roomote in a comment to request specific changes to this pull request or fix all unresolved issues.}

[0xMink]

Applied nit: removed canonicalCommand alias and used command directly. Tests still passing (37/37).