perf(syntax): replace HTML5NamedCharRefs table with browser-native textarea decoder

[NullVoxPopuli-ai-agent]

Summary

• Drops the ~2200-entry HTML5NamedCharRefs lookup table from @glimmer/syntax in favour of a lazily-created <textarea> element for named entity decoding
• The browser (or happy-dom / jsdom in SSR) natively knows every HTML5 entity — no bundled table needed
• Removes simple-html-tokenizer as a runtime dependency of @glimmer/syntax, saving ~32 kB uncompressed from the browser bundle
• Numeric refs (& / &) are unchanged — already handled inline with String.fromCodePoint
• A !text.includes('&') fast path skips the regex entirely for text nodes with no entities, which is the common case

Stacked on emberjs#21308. Addresses the entity-decoding discussion in emberjs#21308 (comment).

How it works

let _entityDecoder: HTMLTextAreaElement | undefined;

function decodeEntities(text: string): string {
  if (!text.includes('&')) return text;
  return text.replace(ENTITY_RE, (match, _body, hex, dec, _name) => {
    if (hex !== undefined) return String.fromCodePoint(parseInt(hex, 16));
    if (dec !== undefined) return String.fromCodePoint(parseInt(dec, 10));
    _entityDecoder ??= document.createElement('textarea');
    _entityDecoder.innerHTML = match; // e.g. "&" → value === "&"
    return _entityDecoder.value;
  });
}

The <textarea> element uses the HTML RCDATA content model — it decodes character references but does not parse child elements, so there is no XSS surface. Unknown entities pass through as-is (matching the previous ?? match fallback). The element is created once and reused.

🤖 Generated with Claude Code