fix: harden Markdown code formatting

[neonwatty]

Summary

• replace the two CodeQL-flagged sanitizer patterns with shared Markdown formatting helpers
• use fences longer than embedded backtick runs instead of relying on backslash escaping inside code spans
• preserve the existing GitHub-rendered table behavior while avoiding the flagged replace-based implementation
• add focused regressions for embedded backticks, pipes, unrelated backslashes, and backslash runs

Finding classification

• structured-feedback formatter: valid robustness finding; backslash does not escape a backtick inside a Markdown code span
• legacy route table formatter: CodeQL heuristic false positive for GitHub GFM; GitHub's renderer keeps the exact generated value in one cell, so this PR preserves that output while removing the flagged construct

Validation

• make check: 405 release tests plus lint, formatting, strict types, knip, audit, and workflow contracts
• npm test: 69 files, 981 tests
• focused route/Markdown suite: 116 tests
• GitHub Markdown API rendered the adversarial backslash-plus-pipe row as one correctly aligned cell
• required review toolkit: correctness, tests, contracts/types, and simplification; no validated findings survived

CodeQL proof

The PR CodeQL run must confirm alerts 3 and 4 are absent from the changed code before merge.