fix(csdl): escape attributes and reject malformed entity references

.ci/readability-baseline.env

@@ -6,6 +6,6 @@ PROD_FILES_GT1000=22
 PROD_MAX_FILE_LINES=2829
 PROD_MAX_FILE_PATH=crates/temper-server/src/storage/mod.rs
 ALLOW_CLIPPY_COUNT=35
-ALLOW_DEAD_CODE_COUNT=14
+ALLOW_DEAD_CODE_COUNT=16
 PROD_PRINTLN_COUNT=247
 PROD_UNWRAP_CI_OK_COUNT=132

.github/workflows/ci.yml

@@ -265,6 +265,20 @@ jobs:
       - name: cargo test --workspace -- --skip dst_
         run: cargo test --workspace -- --skip dst_
 
+      # spec_validate_endpoint declares required-features = ["observe"]. The
+      # workspace run above usually still covers it via feature unification
+      # (temper-cli/temper-mcp enable temper-server's observe feature), but
+      # that coverage is incidental — it evaporates if those edges change.
+      # Run the observe-gated tests explicitly so coverage is guaranteed.
+      - name: cargo test observe-gated tests
+        run: |
+          cargo test -p temper-server --features observe --test spec_validate_endpoint
+          cargo test -p temper-server --features observe --lib observe::
+          # api::repl tests (incl. server_repl_config_never_allows_host_ops,
+          # the ARN-166 host-op isolation guard) compile only under `observe`;
+          # run them explicitly so coverage never depends on feature unification.
+          cargo test -p temper-server --features observe --lib api::repl::
+
   # ─────────────────────────────────────────────────────
   # Gate 3b: DST/platform coverage (matrixed)
   # ─────────────────────────────────────────────────────