fix(security): keep the theme boot script a literal and drop regex tag stripping

The boot script interpolated its two colours; it is one string literal now,
checked against THEME_COLOR by the script's own tests. The retired-route
guard escapes every regex metacharacter including the backslash, and the
two markup tests read text by walking the string instead of stripping tags
with a regex.

src/__tests__/retired-route-links-guard.test.ts

@@ -24,6 +24,11 @@ function walk(dir: string): string[] {
   });
 }
 
+/** Every regex metacharacter escaped, the backslash included. */
+function escapeRegExp(text: string): string {
+  return text.replace(/[\\^$.*+?()[\]{}|/]/g, "\\$&");
+}
+
 describe("no link targets a retired route", () => {
   const files = walk(join(ROOT, "src"));
 
@@ -33,7 +38,7 @@ describe("no link targets a retired route", () => {
 
   it.each(Object.entries(RETIRED))("%s is linked as %s", (route) => {
     const pattern = new RegExp(
-      `(?:href|push|replace)[=(]\\s*\\{?\\s*["'\`]${route.replace(/\//g, "\\/")}["'\`?#]`,
+      `(?:href|push|replace)[=(]\\s*\\{?\\s*["'\`]${escapeRegExp(route)}["'\`?#]`,
     );
     const offenders = files
       .filter((file) => pattern.test(readFileSync(file, "utf8")))