v0.2.18

fix: render policy filenames and commands as inline code (#90)

Render matching filenames and standalone /approve and /merge commands as inline code in policy failure comments. Decode the existing JSON-quoted filename lines before escaping them, so file quotes disappear while HTML, mentions and unusual characters remain safe. Preserve the wrapping layout, original metadata, size bound, publication and hide-on-success behavior.

Extend the existing escaped report regression and existing scratch feedback probe; no new test suite or authorization changes. Runtime version 0.2.18. The reported herdr-linear-agent #157 comment was updated in place.

Validation:
- Existing escaped report regression and local all-target Clippy passed; independent review passed HTML/mention escaping, exact command token matching and unchanged lifecycle.
- [Required CI](https://github.com/civitaspo/securefix-server/actions/runs/38685477194) passed standard checks for `ebc172f3ae651dbf000457548f9c3564c97effdd`.
- [Candidate scratch prepare](https://github.com/civitaspo/securefix-server/actions/runs/38685499616/job/116259825457) passed actual inline filename/command comment publication, supersession and minimize-on-success in testing-securefix-server. Client smoke also passed. Fixtures cleaned up. Unrelated merge/release scenarios were not rerun.
- The reported comment was updated in place and GitHub-rendered HTML verified for inline filenames and /approve, retaining CI/commit metadata.