Fix XSS: stop reinterpreting DOM-derived text as HTML in debug badge

[Copilot]

CodeQL alert #13 (js/xss-through-dom): sec.getAttribute("data-section") was interpolated into an HTML string and written to badge.innerHTML, allowing a controlled data-section attribute to inject arbitrary HTML/script.

Change

Replace the innerHTML string-building approach with safe DOM APIs throughout the section badge construction in methoddriven4.html:

// Before — DOM text flows unsanitized into innerHTML
let html = `${id}  ${Math.round(actual)}px`;
// ...
html += ` <span class="${cls}">est=${est} Δ${sign}${delta}</span>`;
badge.innerHTML = html;

// After — DOM APIs; text is never parsed as markup
badge.textContent = txt;          // plain-text portion
const span = document.createElement("span");
span.className = cls;
span.textContent = `est=${est} Δ${sign}${delta}`;
badge.appendChild(document.createTextNode(" "));
badge.appendChild(span);