[xiaoheiai4719-collab]

What

Fix repository script entrypoints in checkout paths containing URL-encoded characters.

Why

Seven repository scripts compare import.meta.url with a raw file://${process.argv[1]} string. Node URL-encodes the former but not the latter, so a checkout directory containing a space, %, or # can make the command silently skip its entrypoint and exit successfully without checking or generating anything.

Related work

Related: #5543 decodes URL pathnames in other scripts and tests. This correction instead covers seven entrypoint guards and the SVG generator import; it does not duplicate that PR or close its scope. No separate issue is needed for this self-contained correction.

How

• Compare filesystem paths with fileURLToPath(import.meta.url) in those seven guards.
• Keep the SVG generator's esbuild import as a file URL too, so encoded directory names do not fail during module loading.
• Exercise the real script entrypoints in disposable checkouts with encoded path characters, including invalid-input diagnostics, local generated outputs, and import-only controls.

This does not change validation rules, generated content, package APIs, dependencies, or the Node version requirement. The fixtures never publish, contact GitHub, or write outside their temporary checkout.

Test plan

• 176 affected Node script tests pass on Node 24.19.0.
• 42 existing SVG sanitizer parity tests pass.
• All 15 path regression/import tests pass on Node 22.0.0. Against upstream production sources, the same tests fail in eight cases.
• Every command in the root lint chain passes when invoked through Node/tsx and oxlint directly; oxlint . reports no warnings or errors.
• oxfmt --check ., changed-file syntax checks, deletion guard, comment checks, and git diff --check pass. The explicit comment check retains one existing non-failing source-citation warning in the catalog generator header.

Full workspace build/tests and browser/render lanes were not run. On Node 22.0.0, the broader affected suite has three existing TODO-link test failures because its unchanged code uses URL.parse; all three also fail on upstream. The new regression tests pass on that version. No Windows or macOS runtime was available.

AI-assisted implementation and tests: OpenAI Codex.

• Unit tests added/updated
• Manual testing performed (automated CLI regressions only)
• Documentation updated (not applicable: no public interface change)
• Comments follow CONTRIBUTING.md; explicit checks passed with one existing non-failing citation warning as noted above