fix: replace HTMLEditFormat with EncodeForHTML in packagelist

[bpamiri]

Summary

Adobe ColdFusion 2025 does not provide HTMLEditFormat, so GET /wheels/packages 500s with Variable HTMLEDITFORMAT is undefined. This is one of the two bugs reported on #3378 (the other is wheels-basecoat boolean switch and is out of scope here).

vendor/wheels/public/views/packagelist.cfm now uses EncodeForHTML at every former HTMLEditFormat site — the same encoder already used by other /wheels admin views (helpers.cfm, routetesterprocess.cfm). Escaped output is unchanged. No other public views called HTMLEditFormat.

Related Issue

#3378 (packages-admin half only; does not address the Basecoat switch compile error)

Type of Change

• Bug fix
• New feature
• Enhancement to existing feature
• Documentation update
• Refactoring

Feature Completeness Checklist

• DCO sign-off -- Every commit carries Signed-off-by:
• Tests -- Structural spec asserts packagelist.cfm no longer calls HTMLEditFormat and encodes with EncodeForHTML
• Framework Docs -- N/A (admin-page encoder swap)
• AI Reference Docs -- N/A
• CLAUDE.md -- N/A
• Changelog fragment -- changelog.d/3378-packagelist-encodeforhtml.fixed.md
• Test runner passes -- wheels.tests.specs.packages on Lucee 7 + SQLite: 136 pass / 0 fail / 0 error

Test Plan

• Source scan: vendor/wheels/public/views/packagelist.cfm has zero HTMLEditFormat and uses EncodeForHTML
• directory=wheels.tests.specs.packages on local Lucee 7 + SQLite
• Spec PackageListHtmlEditFormatSpec fails against the old view (2 fail) and passes after this change (136 pass)
• Existing packagelist specs in the packages directory still pass

Screenshots / Output

N/A — encoder swap; same escaped markup.

TDD red/green (Lucee 7 + SQLite, directory=wheels.tests.specs.packages):

• RED (temporary HTMLEditFormat restore): 134 pass, 2 fail (does not call HTMLEditFormat, encodes registry output with EncodeForHTML)
• GREEN (this change): 136 pass, 0 fail, 0 error, 15 bundles