Description

The test "escapes XML special characters in filenames to prevent injection" in src/media-understanding/apply.test.ts fails on Windows CI because < and > are not valid characters in NTFS filenames.

Error: ENOENT: no such file or directory, open
  'C:\Users\RUNNER~1\AppData\Local\Temp\moltbot-media-eYTsuC\file<test>.txt'

Introduced in #3700 (commit b717724).

Fix

Use & instead of <> — valid on all platforms, still requires XML escaping:

- const filePath = path.join(dir, "file<test>.txt");
+ const filePath = path.join(dir, "file&test.txt");

Update assertions:

- expect(ctx.Body).toContain("<");
- expect(ctx.Body).toContain(">");
- expect(ctx.Body).not.toMatch(/name="[^"]*<[^"]*"/);
+ expect(ctx.Body).toContain("&amp;");
+ expect(ctx.Body).not.toMatch(/name="[^"]*&[^"]*"/);

Impact

All PRs currently show a failing Windows CI check unrelated to their changes.