fix(lint): decode entity-encoded variable values

[miguel-heygen]

What

Decode HTML entities in data-variable-values before validating the attribute as JSON.

Why

Studio serializes edited JSON attributes with double-quoted HTML attributes and entity-encoded inner quotes. That markup is valid HTML and browsers expose decoded JSON, but StaticGuard lint parsed the raw " text and reported invalid_variable_values_json.

How

• Decode standard named and numeric entities in JSON attribute values.
• Add a regression test covering Studio-style serialization, including an encoded ampersand in a string value.

Test plan

• bun run --filter @hyperframes/lint test (363 tests passed)
• bun run --filter @hyperframes/lint typecheck
• bunx oxfmt --check packages/lint/src/utils.ts packages/lint/src/rules/composition.test.ts
• bunx oxlint packages/lint/src/utils.ts packages/lint/src/rules/composition.test.ts
• git diff --check

Note: the repository-wide pre-commit typecheck currently cannot resolve the ungenerated Producer runtime-inline module in a fresh worktree; package-scoped lint typecheck passes.

[miguel-heygen]

Closing in the owner-scoped backlog value sweep. This is a narrow lint/audit/docs/example/skills refinement, is currently conflicting, or adds more maintenance surface than its demonstrated user impact justifies. Reopen only if a current reproducible case makes it a priority again.