fix(capture): drop *-prefixed attributes to keep XMLSerializer output well-formed - #445

Summary

Fixes #446.

HTML attribute names beginning with * (e.g. Angular structural directives like *ngIf, *ngFor, or any custom *data-foo) are valid in HTML5 but illegal in XML — * is not a NameStartChar. They survive cloning, get serialized by XMLSerializer.serializeToString into <foreignObject>, and the resulting data: URL is malformed. img.decode() then throws EncodingError: The source image cannot be decoded..

Problem

sanitizeAttributesForXHTML already strips attribute names that would break the XHTML serializer:

• @ — never valid in XML
• unknown : prefixes (only xml / xlink allowed)
• framework directives (x-*, v-*, :, on:*, bind:*, let:*, class:*)

* is another NameStartChar violation but was missing from that pass. Browsers don't enforce XML rules on serialization, so this only blows up downstream at img.decode(). Any Angular app — or any code that calls setAttribute('*name', …) — hits this.

Change

Add a single rule to sanitizeAttributesForXHTML:

if (name.startsWith('*')) { el.removeAttribute(name); continue }

Placed outside the stripFrameworkDirectives opt-out because it's an XML-spec rule, not a framework convention — * should always be stripped regardless of options.

__tests__/snapdom.starAttributes.test.js:

• reproduces the EncodingError on a node with *ngIf / *ngFor / *data-custom
• asserts the serialized SVG contains no *-prefixed attributes

Test plan

• New tests fail on main (EncodingError + *-attrs present in SVG)
• New tests pass with this change
• Full suite: npx vitest run --browser.headless → 553 passed, 1 skipped, 0 failed
• npm run lint clean
• Cross-checked with related tests: snapdom.attributes.test.js, snapdom.invalidXMLChars.test.js pass unchanged