fix(feed): escape bare ampersands in entry HTML attribute URLs

linkedom escapes & in text nodes but not in attribute values, so URLs
with query strings (?a=1&b=2) serialized with bare ampersands. Valid XML
inside the feed CDATA, but the W3C validator parses the embedded HTML and
warns "Named entity expected. Got none." on <description>/<content:encoded>
(RSS) and <summary>/<content> (Atom). Escape every & not already starting
a valid entity; covers all three formats via processEmailContent.

Co-Authored-By: Claude Opus 4.7 <[email protected]>

CHANGELOG.md

@@ -22,6 +22,10 @@ verbatim as the GitHub Release notes — so what you write here is what ships.
   cached negatively for 6 hours instead of a full week, so a domain whose icon
   was momentarily unavailable (e.g. not yet indexed upstream) is retried on the
   next email instead of staying blank for days.
+- Feed entry HTML now escapes bare ampersands in attribute URLs (e.g. query
+  strings like `?a=1&b=2`), clearing the W3C feed validator's "Named entity
+  expected. Got none." warning and improving interoperability with stricter
+  feed readers.
 
 ## [0.3.1] - 2026-05-25