chore: fit the loop-locals fix within the production gate

Three things the gate caught that the test suite could not.

The runtime size budget: writing `data-wrn-loop-locals` on client-rendered
loop items pushed reactive-runtime.ts to 51,603 against a 51,400 budget that
had only 125 bytes of headroom. Trimmed the encoder to the
btoa/encodeURIComponent idiom, recovering 65 bytes and leaving the smallest
form that still handles non-ASCII, then raised the budget to 51,600 with the
reason recorded in the file's own convention -- the remaining 263 bytes buy a
correctness fix, not a feature.

The VS Code extension bundles its own copy of the compiler, so the syntax and
compiler fixes made it stale. Rebuilt.

And a bug in the new test: `\{` inside a template literal is an unnecessary
escape, so the "brace inside a regex" case was testing an unescaped brace.
`\{` tests the case it was written for.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/security-performance-audit.mjs

@@ -183,7 +183,15 @@ const runtimeBudgets = {
    */
   // Raised to 51_400: the callApi transport (query building, CSRF header,
   // JSON body, success/failure contract) for compiled api blocks bought ~1,025 bytes.
-  "reactive-runtime.ts": 51_400,
+  //
+  // Raised to 51_600 on 2026-08-22: writing `data-wrn-loop-locals` onto
+  // client-rendered for-loop items bought 263 bytes. Without it a component's
+  // output binding inside a loop resolved no locals and silently dropped every
+  // call, while a plain DOM handler in the same position worked -- so the cost
+  // buys a correctness fix, not a feature. The encoder was trimmed to the
+  // btoa/encodeURIComponent idiom first, which recovered 65 of those bytes;
+  // what remains is the smallest form that still handles non-ASCII.
+  "reactive-runtime.ts": 51_600,
   "component-controllers.ts": 24_100,
   "nav-runtime.ts": 12_000,
   "realtime-runtime.ts": 8_000,