fix(core): restore IIFE with </script> escaping for composition scripts

The Function constructor (3bb0d1ef) was a security hardening to prevent
</script> injection, but it broke sub-composition DOM proxy scoping.
This restores the inline IIFE (preserving closure scope) while adding
</script> → <\/script> escaping to maintain the injection prevention.

Updates tests to match the new IIFE output shape.

Closes #1074

packages/core/src/compiler/compositionScoping.ts

@@ -486,7 +486,7 @@ export function wrapScopedCompositionScript(
   var __hfRun = function() {
     try {
       (function(document, gsap, window, __hyperframes) {
-${source}
+${source.replace(/<\/(script)/gi, "<\\/$1")}
       }).call(window, __hfScopedDocument, __hfScopedGsap, __hfScopedWindow, __hfScopedHyperframes);
     } catch (_err) {
       console.error(__hfErrorLabel, __hfCompId, _err);