#83 issues/pulls: generated HTML in title= corrupts every row

What

The issues and pulls indexes pass generated HTML into a title= attribute:

• src/forge.rs:1146 — title="{state}", title="{created}"
• src/forge.rs:1215 — same for pulls

state is <span class="pill ...">closed</span> and created is <time ...>1h ago</time>, so the inner quotes terminate the attribute. Every row renders literal closed"> / 1h ago">1h ago, and mobile cards show the same noise. The malformed markup also includes attributes that were meant for inner elements on the <td>.

This is not XSS today (the inner text is escaped, state classes are fixed), but it is fragile: any future user-controlled content in those titles becomes an injection point.

Reproduced

/issues/index.html and /pulls/index.html:

<td ... title="<span class="pill state-closed">closed</span>"><span ...

Visible: closed"> [closed] and 1h ago">1h ago.

Fix

Keep plain-text and HTML variants per cell: escaped plain issue.state / relative age in title=, HTML pill/time in the body. Add a test that the index contains no title="< and no "> artifacts.