fix: encode angle brackets in Markdown work item comments

[jztmanyl]

Follow-up to #1634, as suggested there.

When a Markdown comment is stored, the Azure DevOps REST API drops text inside < and >. For example, `<LeftNav />` becomes an empty code span. The MCP server is not at fault, but agents often write this text, and the server is the one place that can compensate for all callers. #500 (#508) did the same for Markdown work-item fields with encodeFormattedValue. wit_work_item_comment_write is the remaining Markdown path on work items without it.

The change encodes &, < and > once for Markdown comment add and update, after mention resolution:

• @<GUID> tokens and resolved @<email> mentions are kept as mention tokens.
• Unresolved @<email> text is encoded like other text.
• HTML-format comments are unchanged.

& is also encoded, so an intentional literal entity such as < survives. encodeFormattedValue encodes only < and >. If you prefer the two paths to match, I can switch comments to that helper.

GitHub issue number

Fixes #1634

Associated Risks

A caller who puts raw HTML in a Markdown comment now sees it as literal text instead of rendered HTML. This matches the field behavior since #500. Callers who need HTML can use format: "Html", which is unchanged.

✅ PR Checklist

• I have read the [contribution guidelines](https://github.com/microsoft/azure-devops-mcp/blob/main/CONTRIBUTING.md)
• I have read the [code of conduct guidelines](https://github.com/microsoft/azure-devops-mcp/blob/main/CODE_OF_CONDUCT.md)
• Title of the pull request is clear and informative.
• 👌 Code hygiene
• 🔭 Telemetry added, updated, or N/A
• 📄 Documentation added, updated, or N/A
• 🛡️ Automated tests added, or N/A

🧪 How did you test it?

• I added 14 regression tests that check the outgoing request body for comment add and update. They cover Markdown, HTML, resolved and unresolved mentions, JSX, generics, operators, literal entities and fenced code. All 14 fail without the source change and pass with it.
• The full suite passes (1,325 tests), and so do npm run build, ESLint and Prettier on the changed files.
• Against a live Azure DevOps organization, using the unpatched server: a comment with an unencoded `<LeftNav />` showed an empty code span, and the same comment with encoded brackets showed <LeftNav /> correctly. A live write through the patched build has not been run yet.

[jztmanyl]

@microsoft-github-policy-service agree

[Codecov Comments Bot (codecov-commenter)]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (main@1919d27). Learn more about missing BASE report.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1641   +/-   ##
=======================================
  Coverage        ?   99.91%           
=======================================
  Files           ?       23           
  Lines           ?     2327           
  Branches        ?      721           
=======================================
  Hits            ?     2325           
  Misses          ?        0           
  Partials        ?        2           

Flag	Coverage Δ
unittests	99.91% <100.00%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[jztmanyl]

Dan Hellem (@danhellem) Thanks for reviewing and merging this :)

Is a 2.11.0 release planned soon? We'd like to move our team's setup to a stable version that includes this fix, and we'll use the nightly until then. No rush, I'm just asking so we can plan.