fix(cli): preserve literal WebVTT cue text

[user-github-me]

WebVTT sidecars write normalized transcript text directly as cue markup. A literal <config> disappears when Chrome displays the cue, and literal < becomes <. Importing encoded cues also keeps entity spellings instead of their displayed characters, so export/import does not preserve the text.

Escape ampersands and angle brackets in exported WebVTT payloads, and decode imported character references once after the existing tag removal. Reuse the existing linkedom dependency, protect literal less-than signs before entity decoding, and skip decoding for plain cues without ampersands. Add literal-text round trips and encoded payload cases, including numeric entities, actual cue formatting, unknown entities, and bidirectional marks.

Validation:

• Ten new cases fail before the fix; 225 caption/transcription tests pass afterward, with one existing platform skip. The final normalizer suite passes all 51 tests.
• Actual CLI: five exports/reimports and seven encoded imports preserve text and timing; repeated exports are byte-stable and leave inputs unchanged.
• Chrome native TextTrack display matches expected text and timestamps in all twelve CLI-generated or imported cases.
• CLI build/typecheck, repository lint, formatting, comment checks, and all commit hooks passed.

[jrusso1020]

Escaping &, < and > on export is what the WebVTT spec requires, and decoding character references once on import makes an export followed by a re-import round-trip correctly. The tests cover the important edge cases. One ordering note: with decoding in place, an imported </script> becomes a literal </script> that reaches patchCaptionHtml, so this should land after #5226, which escapes it there. Minor and optional: the linkedom document could be created once per parse instead of once per cue.

— Rames