test(formula): pin the refused direction of the hole placement scan's tag-open and script escape corrections (#25351) (#25730)

Closes #25351

The maintainer's action on #25351, written under the maintainer's
delegation in chat: two refused-direction rows in the class-by-class
refused table of
`packages/formula/src/mail-html-hole-placement.test.ts`, one per scan
correction of `86330c090` (PR #25212), as contract review `6342085020` ③
asked. Test-only: no change to the classifier, the rule, its doors or
the renderer.

Per the card's disclosure rule, this body names each row by class only;
the samples live in the test source.

## The two rows

1. **The tag-open state.** A hole inside a tag that opens immediately
after a character the tag open state reconsumes in the data state
answers `tag` and is refused.
2. **A script element's escape states.** A hole after an end tag in a
script element's double-escaped text answers `raw-text-element` and is
refused.

Both rows were built from the HTML Living Standard's tokenizer section
(the tag open state; the script data escaped and double escaped states).

## Ablation (local, against the classifier at this PR's base)

Each correction of `86330c090` in
`packages/formula/src/mail-html-hole-placement.ts` was reverted on its
own, the file run, and the correction re-applied; the file was
byte-identical to the base after each restore.

| Correction reverted | Rows red | Reading |
| --- | --- | --- |
| Tag open state: reconsume in the data state (back to a plain return to
data) | 1 of 48: the `tag` row added here | expected `tag`, received
`element-text` |
| Script escape states: the escape flag's arm/disarm and the end-tag
guard removed | 1 of 48: the `raw-text-element` row added here |
expected `raw-text-element`, received `element-text` |

With both corrections in place: 48 of 48 pass in this file.

## Verification

- `packages/formula`: `vitest run`, 53 files and 1424 tests pass; `pnpm
typecheck` (including `check:test-typecheck`) passes.
- `eslint` on the changed file: clean.

## Declarations

Clause-②: no
Metadata-protocol: none

Test-only, so no changeset: the diff publishes nothing from any released
package, and this PR carries `skip-changeset`, as the card's acceptance
states.

---
_Generated by [Claude Code](https://claude.ai/code)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: hotlong

packages/formula/src/mail-html-hole-placement.test.ts

@@ -59,6 +59,8 @@ describe('the refused placements, by class', () => {
     ['<style>p { color: {{x}} }</style>', 'raw-text-element'],
     ['<noscript>{{x}}</noscript>', 'raw-text-element'],
     ['<plaintext>{{x}}', 'raw-text-element'],
+    // The script data double escaped state: an end tag there does not end the element.
+    ['<script><!--<script></script>{{x}}</script>', 'raw-text-element'],
     ['<!-- {{x}} -->', 'comment'],
     ['<!--[if mso]><p>{{x}}</p><![endif]-->', 'comment'],
     ['<!DOCTYPE {{x}}>', 'comment'],
@@ -68,6 +70,8 @@ describe('the refused placements, by class', () => {
     ['<p {{x}}>a</p>', 'tag'],
     ['<{{x}}>', 'tag'],
     ['</{{x}}>', 'tag'],
+    // The tag open state: a character that opens no tag is reconsumed in the data state.
+    ['<<p {{x}}>a</p>', 'tag'],
     ['<p title="a"{{x}}>a</p>', 'tag'],
     ['<p data-{{x}}="1">a</p>', 'tag'],
     ['<a href="{{x}}">a</a>', 'url-attribute'],