Merge dev into main (#128)

* fix: escape HTML angle brackets in midi-demo card renderer

<S> in flag text (e.g. --strength <S>, --min-score <S>) was parsed by the browser as the <s> (strikethrough) element, bleeding strikethrough through the rest of each card. Add an esc() helper and apply it to cmd, desc, flags, and ret before inserting into innerHTML. The example field is left unescaped as it contains intentional HTML span tags.

* feat: align code-demo nav with midi-demo nav style

Replaces the flat tag-row header in code-demo.html with the same three-zone layout used in midi-demo.html: - Left: 'Muse' logo (monospace, accent colour) - Centre: title 'Hexagon API Gateway · Muse VCS' + metadata row (6 acts · 6 commits · 4 branches · 25 symbols, module tags, conflict/agent/language badges) - Right: v0.1.2 version badge + MIDI Demo / Code Demo links

Nav height bumped 52px → 60px and body padding-top updated to match.

* feat: add all 29 code semantic porcelain commands to code-demo

Expands the CLI reference section at the bottom of code-demo.html from 14 commands to all 29, grouped into 7 categories matching the MIDI demo pattern (group header with icon, label, description, and count badge):

1. Snapshot & Inventory — symbols, languages, grep, codemap 2. Symbol Identity & Hist — blame, symbol-log, lineage, detect-refactor 3. Query & Search — query, query-history, find-symbol, code-query 4. Architecture & Quality — hotspots, stable, coupling, compare, clones, coverage, api-surface 5. Impact & Dependencies — deps, impact, dead, breakage 6. Write & Transform — patch, checkout-symbol, semantic-cherry-pick 7. Infrastructure & Gates — index, invariants, check

Renderer updated to use GROUPS array + HTML-escape (esc()) for all text fields; example blocks with intentional span tags are exempt.

---------

Co-authored-by: Gabriel Cardona <gabriel@tellurstori.com>