fix(report): prevent code-fence breakout in vulnerability markdown

[thejesh23]

What

render_vulnerability_md now opens the poc_script_code and code snippet
fences with a backtick run longer than any run inside the payload, so those
LLM/target-authored values always render verbatim and cannot break out of the
code fence.

Why

Both blocks used a fixed three-backtick fence with no escaping. A triple-backtick
inside the value closed the fence early and everything after it rendered as live
markdown — e.g. an injected ## heading and a ![](https://evil/beacon.png)
tracking image — in a report that is a shareable deliverable (GitHub, dashboards,
PRs). The values originate from a scan of an attacker-influenced target.

Change

• Add _safe_fence(content): returns a fence one backtick longer than the
  longest backtick run in content (min 3). Per CommonMark a fenced block closes
  only on a fence at least as long as the opener, so breakout becomes impossible.
• Apply it to the poc_script_code block and the code snippet block.
• The adjacent ```diff block is deliberately left unchanged: every line there
  is prefixed with - /+ , so no line can be a bare-backtick closing fence.
• Benign payloads still get a plain three-backtick fence (byte-identical output).
• Tests cover a poc_script_code breakout attempt and a snippet breakout
  attempt, asserting the payload stays enclosed.

Fixes #815

[greptile-apps]

Greptile Summary

This PR prevents attacker-influenced report content from escaping Markdown code blocks. The main changes are:

• Adds a helper that selects a fence longer than every backtick run in the content.
• Uses dynamic fences for proof-of-concept scripts and code-location snippets.
• Adds tests for breakout attempts in both protected fields.

Confidence Score: 5/5

This looks safe to merge.

• No blocking issues found in the changed code.

Important Files Changed

Filename	Overview
strix/report/writer.py	Adds safe dynamic fences and applies them consistently to both attacker-influenced code blocks.
tests/test_report_writer.py	Adds focused tests for proof-of-concept and snippet fence-breakout payloads.

_{Reviews (1): Last reviewed commit: "fix(report): prevent code-fence breakout..." | Re-trigger Greptile}