fix: stop $ sequences in selected text corrupting the prompt

lib/build-url.js

@@ -21,7 +21,12 @@ function applyTemplate(template, query) {
   }
   const tpl = typeof template === "string" ? template : "";
   if (tpl.includes("{query}")) {
-    return tpl.replaceAll("{query}", query);
+    // Replacer function, not a replacement string: String.prototype.replaceAll
+    // gives $&, $`, $', and $$ special meaning in a replacement STRING, and
+    // `query` is arbitrary page-selected text that can contain any of those
+    // (shell one-liners routinely do). The function form disables that
+    // interpretation entirely. Do not "simplify" this back to the string form.
+    return tpl.replaceAll("{query}", () => query);
   }
   const trimmed = tpl.trim();
   return trimmed === "" ? query : `${trimmed} ${query}`;