HTML API: Decode semicolonless legacy references before non-ASCII attribute followers

[sirreal]

Summary

• Decode semicolonless legacy named references before non-ASCII attribute followers.
• Replace locale-sensitive ctype_alnum() checks with explicit ASCII byte checks.
• Preserve the HTML ambiguity rule for ASCII alphanumeric and = followers.

Testing

• Focused decoder PHPUnit coverage for non-ASCII and ASCII follower cases passes.
• PHPCS alignment fixes are committed.
• codex review --base trunk.

Trac ticket: https://core.trac.wordpress.org/ticket/65372

Use of AI Tools

AI assistance: Yes
Tool(s): Codex
Model(s): GPT-5.5
Used for: Splitting the fuzzer-discovered fix, PR description cleanup, and code review.

---

This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See GitHub Pull Requests for Code Review in the Core Handbook for more details.

[sirreal]

I have reproduced this, the reproduction prints:

string(18) "26416163757465c280"

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props jonsurrell, sergeybiryukov, dmsnell.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[dmsnell]

This needs Trac ticket references and WPCS will whine if whitespace isn’t adjusted. Maybe @copilot can fix these.

Giving it a preemptive approval. Thanks