fix(security): 属性级转义防注入 + 发布产物扩展名修复

- 链接/图片 href/src/alt/title 与代码块 language 属性改用属性级转义
  （浏览器环境 escapeHTML 不转义双引号，存在属性注入面）
- 修复 title 中反斜杠转义还原，引用链接 title 输出与行内一致
- 产物改用 .mjs/.cjs 扩展名（type:module 下 .js 被 Node 按 ESM 解析，
  require() 拿不到导出）；exports 指向 dist 而非 src TS 源码
- 新增 .gitattributes 强制 LF，避免 Windows CRLF 污染 diff
- 配套测试：title/URL/alt/language 注入防护

package.json

@@ -1,19 +1,21 @@
 {
   "name": "@metona-team/metona-editor",
-  "version": "0.2.4",
+  "version": "0.2.5",
   "description": "Type-safe, lightweight, zero-dependency Markdown Editor. Desktop-first. React-free. Single-file bundle.",
   "type": "module",
-  "main": "dist/metona-editor.js",
-  "module": "src/index.ts",
+  "main": "dist/metona-editor.cjs",
+  "module": "dist/metona-editor.mjs",
   "unpkg": "dist/metona-editor.min.js",
   "jsdelivr": "dist/metona-editor.min.js",
   "types": "dist/metona-editor.d.ts",
   "exports": {
     ".": {
-      "import": "./src/index.ts",
-      "require": "./dist/metona-editor.js",
-      "types": "./dist/metona-editor.d.ts"
-    }
+      "types": "./dist/metona-editor.d.ts",
+      "import": "./dist/metona-editor.mjs",
+      "require": "./dist/metona-editor.cjs",
+      "default": "./dist/metona-editor.js"
+    },
+    "./package.json": "./package.json"
   },
   "files": [
     "dist/",
@@ -27,9 +29,10 @@
     "test": "jest --coverage",
     "test:watch": "jest --watch",
     "lint": "eslint \"src/**/*.ts\"",
-    "lint:fix": "eslint src/ --fix",
+    "lint:fix": "eslint \"src/**/*.ts\" --fix",
     "format": "prettier --write src/",
     "typecheck": "tsc --noEmit",
+    "bench": "node bench/benchmark.cjs",
     "prepublishOnly": "npm run typecheck && npm test && npm run build"
   },
   "repository": {