DOMPurify does not strip <script>/on* handlers under happy-dom (the
default vitest environment), so the "strips <script> tags" assertion
has been failing on main since the sanitizer switched to DOMPurify.
Production is unaffected — real browsers sanitize correctly. Pin this
single test file to jsdom via a per-file environment annotation and add
jsdom as a devDependency; all other tests stay on happy-dom.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
