fix(nitro): Address review bot feedback

Replace local esc() with shared escapeXml from @/chat/xml and escape
all regex-special characters in glob-to-regex conversion, not just dots.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: dcramer

packages/junior/src/handlers/diagnostics-dashboard.ts

@@ -1,14 +1,7 @@
+import { escapeXml as esc } from "@/chat/xml";
 import { GET as diagnosticsGET } from "@/handlers/diagnostics";
 import { GET as healthGET } from "@/handlers/health";
 
-function esc(s: string): string {
-  return s
-    .replace(/&/g, "&")
-    .replace(/</g, "&lt;")
-    .replace(/>/g, "&gt;")
-    .replace(/"/g, "&quot;");
-}
-
 /** Serve an HTML diagnostics dashboard showing health, plugins, and skills. */
 export async function GET(): Promise<Response> {
   let health: { ok: boolean; data?: Record<string, unknown>; error?: string };

packages/junior/src/nitro.ts

@@ -135,7 +135,9 @@ function copyIncludedFiles(serverRoot: string, patterns?: string[]): void {
 
     const entries = readdirSync(sourceDir);
     const re = fileGlob.includes("*")
-      ? new RegExp(`^${fileGlob.replace(/\./g, "\\.").replace(/\*/g, ".*")}$`)
+      ? new RegExp(
+          `^${fileGlob.replace(/[\\^$+?.()|[\]{}]/g, "\\$&").replace(/\*/g, ".*")}$`,
+        )
       : null;
 
     for (const entry of entries) {