fix(blog): replace iterative HTML tag stripping with single-pass angle bracket removal

The CodeQL scanner flagged the iterative stripHtmlTags function for
incomplete multi-character sanitization. The regex /<[^>]+>/g only
matches complete tags, so partial fragments like <script (without a
closing >) could survive intermediate loop iterations.

Since this function is only used for word counting in
calculateReadingTime, replace the multi-step approach with a simple
single-pass removal of all < and > characters. This eliminates the
incomplete sanitization pattern entirely.

Author: roomote

apps/web-roo-code/src/lib/blog/time.ts

@@ -98,20 +98,14 @@ export function formatPostDatePt(publishDate: string): string {
 }
 
 /**
- * Repeatedly strip HTML tags until no more remain.
- * A single-pass replacement is vulnerable to incomplete sanitization when
- * the input contains nested/split patterns like `<scr<script>ipt>`.
+ * Strip all angle brackets from text to remove any HTML tags or fragments.
+ * This is used only for word-count purposes in reading-time calculation,
+ * so a single-pass removal of every `<` and `>` is sufficient and
+ * avoids the incomplete multi-character sanitization pattern that
+ * iterative tag-stripping is vulnerable to.
  */
 function stripHtmlTags(text: string): string {
-	const TAG_RE = /<[^>]+>/g
-	let previous = text
-	let result = text.replace(TAG_RE, "")
-	while (result !== previous) {
-		previous = result
-		result = result.replace(TAG_RE, "")
-	}
-	// Final safety: remove any remaining angle brackets
-	return result.replace(/[<>]/g, "")
+	return text.replace(/[<>]/g, "")
 }
 
 /**