Add comprehensive GitHub Copilot instructions for homebridge-switchbot development

[Copilot]

This PR creates comprehensive GitHub Copilot instructions to help developers work effectively with the homebridge-switchbot codebase. The instructions provide detailed guidance on building, testing, and developing this TypeScript Homebridge platform plugin for SwitchBot smart home devices.

Key Features Added

Complete Development Workflow Documentation:

• Bootstrap and build process with exact commands and timing expectations
• Dependency installation with required --legacy-peer-deps flag due to TypeDoc conflicts
• TypeScript compilation and plugin UI building (~7 seconds)
• Test execution with Vitest (~2 seconds)
• Documentation generation with TypeDoc (~7 seconds)

Validation Scenarios:

• Manual plugin validation to ensure proper Homebridge registration
• Plugin loading verification with Node.js
• TypeScript compilation validation
• Documentation generation without warnings
• Complete workflow timing (~16 seconds total)

Codebase Navigation Guide:

• Detailed project structure with 38 TypeScript files across device and IR device modules
• Key development areas for common tasks (adding devices, configuration changes)
• File relationships and dependencies
• Base classes and extension patterns for device implementations

Known Issues and Workarounds:

• Documented dependency conflicts requiring --legacy-peer-deps
• ESLint configuration issues with import/extensions rule
• Build artifact management with updated .gitignore

Timing and Performance Guidelines:

• All commands tested with realistic timing expectations
• "NEVER CANCEL" warnings for builds with appropriate timeout recommendations
• Complete validation workflow benchmarked at under 20 seconds

Validation

All commands and scenarios in the instructions have been thoroughly tested and validated to ensure they work correctly in a fresh development environment. The instructions follow the imperative tone requirement and provide exhaustive coverage of the development workflow.

The file is located at .github/copilot-instructions.md and provides over 7,000 characters of comprehensive guidance for GitHub Copilot to work effectively with this codebase.

Fixes #1261.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

To fix the problem, we should ensure that any data read from the DOM via getAttribute('data-value') is properly escaped or sanitized before it is ever used in a context where it could be interpreted as HTML. In this code, the main risk is if the value is later inserted into the DOM using innerHTML or similar. The best way to fix this is to sanitize the value as soon as it is read, or to ensure that any code that writes it to the DOM uses safe methods (such as textContent instead of innerHTML). Since we only have access to the code in coverage/sorter.js, and the value is read in loadRowData, we should escape or sanitize val immediately after reading it from the attribute. For numbers, this is not necessary, but for strings, we should escape HTML meta-characters (<, >, &, ", '). We can add a simple HTML escape function in this file and use it when assigning string values to the data object.

Required changes:

• Add an escapeHtml function to the file.
• In loadRowData, use escapeHtml on val if the column type is string.
• No new imports are needed; the escape function can be implemented inline.

---