fix(web): escape prompt editor typeahead query before building RegExp

[manan-tech]

Fixes #38384

Summary

The {-triggered component picker in the prompt editor builds a regular expression directly from the typeahead query string:

const regex = new RegExp(queryString, "i")

The query string is arbitrary prompt text that follows a {. A common prompt such as:

- [Open manual]({source_url})

makes the query string source_url}), which is invalid regex syntax (Unmatched ")"). new RegExp throws a SyntaxError during render, and the whole prompt editor crashes with an unexpected component rendering error. Other characters such as [ (unterminated character class) or a trailing \ fail the same way.

Fix

Escape the query string before constructing the RegExp, using the same inline escapeRegExp idiom already used elsewhere in the codebase (goto-anything, agent-v2, console-openapi-url):

const escapeRegExp = (value: string) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")
...
const regex = new RegExp(escapeRegExp(queryString), "i")

This is applied at both call sites (useVariableOptions and useExternalToolOptions). As a side benefit, the typeahead now matches the query literally instead of interpreting user-typed text as a regex pattern, which is the expected behavior when filtering variable / tool names.

Testing

Added regression tests to the existing component-picker-block/__tests__/hooks.spec.tsx:

• Crash-guard cases (source_url}), a[b, trailing \) for both useVariableOptions and useExternalToolOptions — verified these fail on the unescaped code (exact SyntaxError) and pass with the fix.

• A literal-match assertion confirming a.b matches only a.b, not axb.

• pnpm test on the spec: 67/67 pass

• pnpm eslint on changed files: 0 errors

• pnpm type-check: passes