Mistake: unencoded ampersands and entities in loc

Mistake: unencoded ampersands and entities in loc

URLs with query strings break the XML when &, <, >, or quotes go in raw. One unescaped character makes the parser reject everything after it — you lose the tail of the file, not just one URL.

Fix checklist:
— ✅ & → &, < → <, > → > in every <loc>
— ✅ Non-ASCII paths are percent-encoded (UTF-8) before XML-escaping
— Run output through a real XML serializer; never concatenate strings by hand
— ✅ File is valid UTF-8 with no BOM

Definition of done: pipe the raw file through xmllint --noout sitemap.xml. Exit code 0 is the only pass. A sitemap that renders fine in a browser can still fail strict parsing.