[Paururo]

Fixes the CodeQL alert js/xss-through-dom #1 in docs/assets/site.js.

What was wrong

The policy picker on the website reads the policy name from the clicked button's data-policy attribute and pasted it into summary.innerHTML. The three values in our HTML are fixed, so nothing could exploit it today, but any markup in that attribute would have run: with the code on main, setting data-policy to <img src=x onerror=…> and clicking runs the handler.

The fix

• The sentence is built from nodes: the policy name and orthology_evidence.tsv go into <code> elements with textContent, and the count into <b>. The same injected attribute now shows as literal text and runs nothing.
• escapeHtml in the documentation search also escapes ", and the result links pass their href through it, so the one attribute the search writes cannot be broken out of either.

Checked

• The sentence reads exactly as before for strict, balanced and sensitive (same HTML, same text).
• The injection runs on main and not on this branch.
• Searching from a page one folder down (guide/outputs.html) still gives correct ../ links with highlighting, and the first one opens.
• Locally fmt, clippy, the tests, the build, check_site.py --run-tutorial and the auto-merge gate check all pass.

CodeQL closes the alert on its own once this reaches main.