fix(telegram): escape pool name in rotate-race hint; assert pool removal

the /pool status hint in the rotate-race message wrote the raw pool name
into an HTML-parsed reply, so a name with <,>,& would break rendering;
htmlCode it like the other occurrence. The pool-remove test guarded on
'err == nil', which GetPool returns even for a missing pool; assert the
pool row is actually gone instead.

Author: nnemirovsky

internal/telegram/commands.go

@@ -1318,7 +1318,7 @@ func (h *CommandHandler) poolRotate(name string) string {
 		var race *poolops.RotateRaceError
 		if errors.As(err, &race) {
 			return fmt.Sprintf("Pool %s rotate raced a concurrent membership change; nothing was persisted. Re-check the pool with /pool status %s and retry.",
-				htmlCode(name), name)
+				htmlCode(name), htmlCode(name))
 		}
 		return fmt.Sprintf("Failed to rotate pool: %v", err)
 	}

internal/telegram/commands_test.go

@@ -2172,13 +2172,17 @@ func TestHandlePoolCreateListStatusRotateRemove(t *testing.T) {
 	if !strings.Contains(got, "Removed pool") {
 		t.Fatalf("pool remove = %q", got)
 	}
-	if _, err := s.GetPool("codex"); err == nil {
-		// GetPool returns (nil, nil) for a missing pool; the status command
-		// is the operator-visible "gone" check.
-		got = h.Handle(&Command{Name: "pool", Args: []string{"status", "codex"}})
-		if !strings.Contains(got, "No pool named") {
-			t.Fatalf("status after remove = %q, want not-found", got)
-		}
+	// GetPool returns (nil, nil) for a missing pool, so assert the pool row
+	// is actually gone (p == nil) rather than testing the always-true err.
+	if p, err := s.GetPool("codex"); err != nil {
+		t.Fatalf("GetPool after remove errored: %v", err)
+	} else if p != nil {
+		t.Fatalf("pool still present after remove: %+v", p)
+	}
+	// And the operator-visible status command reports it not-found.
+	got = h.Handle(&Command{Name: "pool", Args: []string{"status", "codex"}})
+	if !strings.Contains(got, "No pool named") {
+		t.Fatalf("status after remove = %q, want not-found", got)
 	}
 }