Fix CodeQL URL and heading findings

[Jason-Doyle]

Summary

• replace trailing-slash regular expressions in remote URL construction with linear scanning
• replace documentation heading HTML stripping with a scanner-based anchor helper
• add regression coverage for slash-heavy paths and malformed HTML-like heading text

Verification

• npm test -- --reporter=dot (43 files, 228 tests)
• npm run check
• npm run verify:docs

Addresses the two open CodeQL code-scanning alerts.