fix(reporter): enable Jinja2 autoescape in report generation

[orbalayla-nvidia]

Both Jinja2 environments in reporter.py rendered scenario data into HTML report files with autoescaping disabled, so a scenario or test name containing markup was written through unescaped. Coverity reports both as JINJA2_AUTOESCAPE_DISABLED.

Sets autoescape=True at both sites (generate_scenario_report, and the DSE report environment).

select_autoescape() is not usable here — it keys off the file extension, and these templates are named .jinja2, which is not in its default list.

No output change expected: the templates these two environments load pass plain scalar values only. The | safe filters elsewhere are in nixl_report_template.jinja2, a different template, and | safe is an explicit opt-out that is unaffected.

These are the only defects Coverity reports on the codebase, which unblocks making the Coverity stage fail on findings.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: NVIDIA/cloudai/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: caf73407-e4c9-4454-9be6-ae87848bd06e

📥 Commits

Reviewing files that changed from the base of the PR and between 9cb98cb and f1b5e47.

📒 Files selected for processing (1)

• src/cloudai/reporter.py

Included review availability: Your plan provides up to 12 included reviews per hour; 10 remain after this review.

---

📝 Walkthrough

Walkthrough

Jinja2 HTML autoescaping is enabled for standard scenario reports and DSE reports.

Changes

Report escaping

Layer / File(s)	Summary
Enable Jinja2 autoescaping src/cloudai/reporter.py	StatusReporter.generate_scenario_report and DSEReporter.generate now create Jinja2 environments with autoescape=True.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to f1b5e

HTML reports will now escape markup in rendered values, reducing injection risk without an identified merge-blocking impact.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: enabling Jinja2 autoescaping in report generation.
Description check	✅ Passed	The description explains the affected environments, security issue, implementation, Coverity findings, and expected output impact. It is directly related to the changeset.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}