fix(kubescape-bridge): contain scanner severity in a code span rather than enumerating metacharacters #2928

🤖 Generated by the Agentic Engineer

sanitizeForIssue neutralizes * but not _ or ~~, so the fix landed for
"Neutralize Markdown in scanner-derived severity" is incomplete against its own stated goal.

Evidence

renderBody writes exactly one scanner-derived field into a live-Markdown context:

fmt.Fprintf(&b, "**Severity:** %s\n", boundField(t.Severity))   // bare — Markdown is live
b.WriteString("- `" + boundField(c) + "`\n")                    // inside a code span — inert

Running the replacer from issues.go verbatim over the Markdown/HTML metacharacter set:

NEUTRALIZED : @ # < [ * `
PASSES THRU : > ] _ ~ | & ! = - +

  **Severity:** *High*     -> "**Severity:** *<ZWSP>High*<ZWSP>"   (neutralized)
  **Severity:** _High_     -> "**Severity:** _High_"               (renders as emphasis)
  **Severity:** ~~High~~   -> "**Severity:** ~~High~~"             (renders as strikethrough)

* and _ are the same Markdown construct; only one of them was covered.

Impact — deliberately graded LOW

I checked every pass-through for a side-effecting vector and found none:

So the reachable effect is cosmetic emphasis only — no mention, no cross-link, no HTML
structure. This is a completeness gap, not a vulnerability, which is why it is filed as a Bug
rather than as Security.

The real cost: the character set is enumerated by discovery

Across 8 review rounds on #2917 the replacer grew @/# → < → *, one round at a time,
each found adversarially rather than derived. _ is simply the next one. The set has no
closure argument, so this recurs.

Smallest useful change

Render Severity through the containment the component list already uses — a code span:

fmt.Fprintf(&b, "**Severity:** `%s`\n", boundField(t.Severity))

A code span is escapable only by a backtick, and sanitizeForIssue already maps ` → '.
That makes every metacharacter inert in one move, including ones not yet enumerated. Verified,
with the control:

in="_High_"     span="**Severity:** `_High_`"     span_escapable=false
in="~~High~~"   span="**Severity:** `~~High~~`"   span_escapable=false
in="x`+live`y"  span="**Severity:** `x'+live'y`"  span_escapable=false

CONTROL (backtick NOT neutralized): "x`+live`y" span_escapable=true   <-- control flips

Acceptance criteria

1. A test asserts _, ~~, | and & in t.Severity cannot produce live markup — RED before
   the change, GREEN after.
2. An ablation removes the backtick→' mapping and the containment test FAILS, proving the
   guarantee rests on that mapping and the test is not vacuous.
3. The anti-churn guarantee is preserved: identical input renders identical bytes.
4. entrySurface still parses the **Surface:** line it round-trips (that line is untouched).

Size: XS — one format string, one test, one ablation.

Part of #2854. Follow-up from #2917; deliberately not folded into it, because that PR is
pentad-clear at head after 8 review rounds and every push restarts a metered review loop.