fix: decode numeric XML character references

[baseballyama]

Summary

• decode decimal and hexadecimal XML character references in text nodes and attributes
• preserve single-pass XML entity semantics so escaped reference text is not decoded twice
• keep CDATA sections literal (they are not entity-decoded)
• reject references to characters XML does not allow (e.g. �) with OpenXmlSchemaError
• cover inline strings and shared strings through loadWorkbook

Verification

• pnpm typecheck
• pnpm lint
• pnpm test (328 files, 2472 tests)
• pnpm build
• pnpm size

Closes #131