fix(plugin): include server-rendered templates in scan inventories

[WenJing95]

Summary

EJS, ERB, and PHTML files were omitted from canonical diff inventories and repository/diff rank inputs because their suffixes were missing from the shared file-type list. These templates can contain application code and security-sensitive output, so they belong in scan coverage.

Changes

• Add .ejs, .erb, and .phtml to TEXT_CODE_EXTENSIONS, using existing sampled-text previews.
• Extend the existing template integration tests to cover all three formats, uppercase normalization, and .html.erb names across repository, revision, and local-patch inputs.
• Reuse existing Git-selection and preview-budget coverage instead of duplicating those tests.

Testing

• Focused inventory, rank-input, and preview modules: 242 passed. Temporary Git fixtures used a clean directory outside existing Git ancestors.
• Regression check: removing the three suffix additions makes all 15 new cases fail, while the five existing Svelte cases still pass.
• Python Ruff lint and formatting checks: passed.
• pnpm --dir sdk/typescript run build:ci: passed.
• Plugin source compatibility checker: passed.
• Source compatibility checker tests: 9 passed. Disabled an injected local Node proxy startup warning for these stderr-sensitive tests.

Risk and rollout

The production change is three entries in the existing shared extension list. Existing exclusions, binary and symlink handling, and preview budgets continue to apply. Templates are read as source, never rendered or executed. Whole-repository canonical inventory already includes these files; this fixes the filtered paths. No CLI changes or migration are required.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[mldangelo-oai]

Thanks for catching this gap. These templates can contain application code and output-escaping decisions, so including them in the filtered inventories and rank inputs is the right behavior. The existing sampled preview is sufficient; no template execution or new parser is needed.

I simplified the coverage by extending the existing template integration tests and removing duplicated Git setup and preview-budget cases. The production fix remains three extension entries. All 15 new cases fail without those entries, and the final focused suite passes all 242 tests. The required portable source checks also pass.

The change is small, useful, and ready to merge. Thanks for the contribution!