Escape GitHub @mentions in template update PR bodies

[Copilot]

Release notes included in cruft update PRs contain raw @username mentions, causing all contributors to be subscribed to 150+ PRs on every release.

• Add _escape_github_mentions() to wrap @username → `@username` using regex with negative lookbehind to skip already-escaped mentions and email addresses
• Apply escaping in TemplateUpdatePR.body after template formatting
• Add parametrized tests covering mentions, emails, backtick-escaped handles, and realistic release notes

>>> _escape_github_mentions("* Fix bug by @grst in https://...")
'* Fix bug by `@grst` in https://...'

>>> _escape_github_mentions("`@already-escaped`")  # unchanged
'`@already-escaped`'

>>> _escape_github_mentions("bot@users.noreply.github.com")  # unchanged
'bot@users.noreply.github.com'

[flying-sheep]

it’s probably fine, but if we wanted this to be robust, we’d need to

1. parse markdown
2. find the spans containing usernames
   • if we parsed it as GFM with the username extension – just use that
   • if we parsed as regular markdown – find the @… pattern in regular text parts (but not code parts or so)
3. replace (I guess just reversing the list of replacements before performing them would be fine)

[grst]

I like the suggestion. Is there any library for GFM parsing that you would recommend?

[flying-sheep]

Hm, the established ones don’t have a real AST with source locations, but this one looks good: https://lbliii.github.io/patitas/

[grst]

are you sure this supports parsing usernames? I couldn't find anything related to that in the docs...

[github-actions]

A PR has been generated to the instance repo: scverse/cookiecutter-scverse-instance#269

You can check out the PR to preview your changes in an instance of the cookiecutter template.
It will be kept in sync with this PR automatically.

[grst]

• I couldn't find any markdown library that natively supports parsing usernames
• I think the edge-cases are not that relevant, since the release notes are typically an autogenerated bulleted list of changes. It should not contain code fences.

I documented the limitations in the code and would leave it at that for now, WDYT?