Fix production dynamic-page modules and trusted email previews

packages/block-editor/test/preview-html.test.ts

@@ -0,0 +1,13 @@
+import { expect, test } from "bun:test";
+import { JSDOM } from "jsdom";
+import { builderPreviewHTML } from "../src/preview-html.ts";
+
+test("preview sanitization preserves email layout and editor markers but removes executable content", () => {
+  const { window } = new JSDOM("");
+  const result = String(builderPreviewHTML('<html><head><style>td{padding:12px}</style></head><body><table data-block-id="one"><tr><td><img src="https://example.com/a.png" onerror="alert(1)"><a href="javascript:alert(1)">Hello</a></td></tr></table><script>alert(1)</script><iframe src="https://example.com"></iframe></body></html>', window.document as unknown as Document));
+  expect(result).toContain('data-block-id="one"');
+  expect(result).toContain('<table');
+  expect(result).toContain('<style>');
+  expect(result).not.toMatch(/onerror|javascript:|<script|<iframe/);
+  window.close();
+});