chore(codeql): resolve deploy scan findings

[7ttp]

TL;DR

fixes the CodeQL check blocking prod deploy & turning merges red
which was caused by two new alerts on develop, and is now fixed by escaping HTML comment openers in the AI review sanitizer instead of stripping comments (stripping was not a fixpoint, so <!<!---->-- re-formed an opener) and

by dropping the trace field from the fallback 500 response in the functions serve template.
The stack is still printed to the terminal by the existing console.error....

ref:

• unblocks: chore: production deploy #6416

[github-actions]

🤖 AI Review

Both independent reviews completed. Claude reported two findings and Codex reported none. Both Claude findings are confirmed: the stack-trace removal leaves an equivalent exposure in onError, and HTML-entity escaping is visibly lossy inside Markdown code spans and fences.

Findings

Severity	Location	Category	Sources	Claim
🟡 MINOR	apps/cli/src/shared/functions/serve.main.ts:474	security	claude	The stack-trace remediation is incomplete because the same Deno.serve call still includes exception stacks in responses produced by onError.
⚪ NIT	.github/scripts/ai-review/post-review.ts:577	ux	claude	Replacing <!-- with &lt;!-- leaves the entity text visibly rendered when model-authored Markdown quotes the opener inside a code span or fenced block.

Findings outside the diff

• 🟡 MINOR apps/cli/src/shared/functions/serve.main.ts:474 — The stack-trace remediation is incomplete because the same Deno.serve call still includes exception stacks in responses produced by onError.

Stats

Claude findings: 2 · Codex findings: 0 · Confirmed: 2 · Refuted: 0 · Uncertain: 0

---

Models: claude-opus-5 + gpt-5.6-sol · Trigger: auto · Workflow run

This review runs once per PR. A maintainer can request another with a /ai-review comment.

[github-actions]

Supabase CLI preview

npx --yes https://pkg.pr.new/supabase/cli/supabase@301a7918fc012620b040b9a1c532bfbb012ab5d6

Preview package for commit 301a791.