fa9e899d4e
before-build.mjs builds the msix-extensions.xml fragment and the hidden CLI <Application> entries from string templates, interpolating the display name and the payload-declared launcher stems raw. A value with `&`, `<` or `"` would corrupt the manifest makeappx reads (an opaque 0x80080204 at best, a differently named alias at worst). Every interpolated attribute now goes through xmlAttribute().