Fix markdown injection and platform-dependent path tests in prompt handlers

- Add sanitizeForInlineCode() helper to escape backticks and newlines in user-supplied values embedded in markdown code spans
- Apply sanitizer to resolvePromptFilePath 'does not exist' warning (filePath and absolutePath)
- Apply sanitizer to formatValidationError issue.received display
- Fix POSIX path separator assumptions in tests: use basename only ('mydb', 'database')
- Rename createSafePromptHandler tests to clarify they validate the handler wrapper, not MCP SDK validation

Co-authored-by: data-douser <70299490+data-douser@users.noreply.github.com>
Agent-Logs-Url: https://github.com/advanced-security/codeql-development-mcp-server/sessions/2660567b-5822-4505-91c2-37fe3ef00f4e

Author: Copilot

server/dist/codeql-development-mcp-server.js

@@ -64468,6 +64468,9 @@ var SUPPORTED_LANGUAGES = [
   "ruby",
   "swift"
 ];
+function sanitizeForInlineCode(value) {
+  return value.replace(/`/g, "'").replace(/\r?\n|\r/g, " ");
+}
 async function resolvePromptFilePath(filePath, workspaceRoot) {
   if (!filePath || filePath.trim() === "") {
     return {
@@ -64503,7 +64506,7 @@ async function resolvePromptFilePath(filePath, workspaceRoot) {
   } catch {
     return {
       resolvedPath: absolutePath,
-      warning: `\u26A0 **File path** \`${filePath}\` **does not exist.** Resolved to: \`${absolutePath}\``
+      warning: `\u26A0 **File path** \`${sanitizeForInlineCode(filePath)}\` **does not exist.** Resolved to: \`${sanitizeForInlineCode(absolutePath)}\``
     };
   }
   return { resolvedPath: absolutePath };
@@ -64599,7 +64602,7 @@ function formatValidationError(promptName, error2) {
     if (issue2.code === "invalid_enum_value" && "options" in issue2) {
       const opts = issue2.options.join(", ");
       lines.push(
-        `- **\`${field}\`**: received \`${String(issue2.received)}\` \u2014 must be one of: ${opts}`
+        `- **\`${field}\`**: received \`${sanitizeForInlineCode(String(issue2.received))}\` \u2014 must be one of: ${opts}`
       );
     } else if (issue2.code === "invalid_type") {
       lines.push(