compat: make PHP 8 HTML escaping behavior explicit

[somethingwithproof]

Summary

• Pass explicit ENT_QUOTES | ENT_SUBSTITUTE flags and UTF-8 to the remaining htmlspecialchars() call.
• Preserve PHP 8.1+ behavior while removing the cross-version compatibility finding.
• Record the compatibility cleanup in the develop changelog.

Audit result

A whole-plugin PHPCompatibility scan for PHP 8.0+ found five findings on develop. This PR resolves the htmlspecialchars() finding. The other four are omitted fputcsv() escape arguments and are already resolved in #326.

Validation

• setup.php passes PHP lint.
• setup.php is clean under PHPCompatibility with testVersion 8.0-.
• The full pre-push review gate passed.

CI infrastructure repair #329 should merge first so this PR inherits the corrected PHP matrix after rebase.