Harden bundle catalog table rendering

Require single-line escaped Markdown table values for untrusted submission metadata. The needs-info label used by validation is now present in the repository.

Assisted-by: GitHub Copilot (model: GPT-5.6 Sol, autonomous)

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: fbe794bc-667a-4c9e-b48b-825067debc6d

Author: BenBtg

.github/workflows/add-community-bundle.lock.yml

@@ -241,6 +241,12 @@ by bundle name:
 | <Name> | <Description> | `<role>` | <component counts> | <None or documented> | [<repo-name>](<repository>) |
 ```
 
+Before rendering the row, convert every user-derived display value to
+single-line plain text: collapse CR/LF sequences to spaces, remove control
+characters, and backslash-escape `\`, `|`, backticks, `*`, `_`, `[`, `]`, `<`,
+and `>`. Use the validated HTTPS GitHub repository URL unchanged only as the
+Markdown link destination.
+
 Render component counts compactly, omitting zero-valued component types. Use
 `None` when no companion catalogs are needed and `Documented` otherwise; the
 repository README remains the source for the actual URLs.