Reword comments, one doc paragraph, and one test failure message so the prose reads naturally. No behaviour change.
elem-go does not escape attribute values, so the raw query reaches the rendered HTML verbatim. Pre-escape with html.EscapeString to prevent reflected XSS. Updates #3157