fix(templates): strip backslash from escaped \{ in token interpolation

[shuvamk]

Summary

An escaped \{ in a string-typed prop value leaks its backslash into published output. The module documents the escape as "emits a literal {not-a-token} with no replacement" (tokenInterpolation.ts:22-23) and parseTokenString implements it correctly — but interpolateTokens never reaches the parser for this input.

The culprit is the containsTokens fast-path heuristic, which deliberately excluded escaped braces:

export function containsTokens(value: string): boolean {
  if (value.length < 5) return false
  for (let i = 0; i < value.length; i++) {
    const c = value[i]
    if (c === '{' && (i === 0 || value[i - 1] !== '\\')) return true  // skips \{
  }
  return false
}

interpolateTokens then short-circuits on the false result:

if (!containsTokens(input)) return input   // returns input verbatim, backslash intact

So "Literal \{not-a-token}" is returned unchanged instead of being parsed to "Literal {not-a-token}". parseTokenString on the same input already yields the stripped literal, so the heuristic and the parser disagree.

The existing test crystallized the bug — its title states the correct behavior while the assertion encoded the wrong one:

it('returns true even for escaped { (the parser will resolve it correctly)', () => {
  expect(containsTokens('Literal \\{not-a-token}')).toBe(false)   // contradicts the title
})

Reproduction

interpolateTokens('Literal \{not-a-token}', ctx)
  before: 'Literal \{not-a-token}'   ← backslash leaks
  after : 'Literal {not-a-token}'    ← literal, as documented

Fix

Any { — escaped or not — needs a parse (the parser is what strips the backslash), so containsTokens now returns true whenever a brace is present.

Safe at every call site:

• publisher/dynamicDetection.ts — an escape-only string parses to text-only segments (no kind: 'token'), so the node correctly stays static; no page is newly promoted to a dynamic hole.
• templates/dynamicBindings.ts (both sites) — now strip the backslash as documented instead of leaking it.

The < 5 length floor is dropped with it: a real token's source (page/site/route/currentEntry/parentEntry) already makes it far longer than 5 chars, but a short escape like \{x} is only 4 and was wrongly skipped.

Verification

• bun run build
• bun test (6333 pass, 0 fail; the flipped assertion + two new interpolateTokens escape tests fail on main and pass with the fix)
• bun run lint

Checklist

• Tests cover behavior changes — corrected the self-contradictory containsTokens assertion and added interpolateTokens escape cases (with and without a real token alongside).
• Docs were updated when behavior, config, deployment, or public surfaces changed — n/a (internal engine; the escape was already documented).
• No compatibility shim was added for old pre-release behavior.
• No secrets, local databases, uploads, or generated artifacts are included.