test(bundler): accept arbitrary content in script close tag

CodeQL still flagged `</script\s*>` as too narrow — the rule wants
tolerance for `</script\t\n bar>` (HTML parser treats trailing content
in a close tag as part of the tag). Switched to `</script[^>]*>` for
full coverage.

The bundler still always emits the canonical `</script>`; this is
test-side hardening, not a runtime fix.

packages/core/src/compiler/htmlBundler.test.ts

@@ -107,7 +107,7 @@ describe("bundleToSingleHtml", () => {
     // the separator, parse would fail with an unexpected-token error somewhere
     // around the chunk boundary.
     const { transformSync } = await import("esbuild");
-    const re = /<script\b[^>]*>([\s\S]*?)<\/script\s*>/gi;
+    const re = /<script\b[^>]*>([\s\S]*?)<\/script[^>]*>/gi;
     let m: RegExpExecArray | null;
     while ((m = re.exec(bundled)) !== null) {
       const body = m[1];