Keep empty HTML clears out of the sink ratchet

Why: Preview setup clears a node with innerHTML = '' before appending sanitized children, and the ratchet treated that space as a write.
Evidence: npx vitest run test/html-sinks.test.ts. Non-empty assignments still match.
Impact: The preview path can keep clearing nodes. Writing HTML strings in components still fails the test.
Refs: docs/records/2026-10-04-sillytavern-review.md

test/html-sinks.test.ts

@@ -22,7 +22,8 @@ describe('html sinks', () => {
       const text = readFileSync(file, 'utf8')
       const rel = relative(SRC, file)
       if (text.includes('dangerouslySetInnerHTML')) hits.push(`${rel}: dangerouslySetInnerHTML`)
-      if (/innerHTML\s*=\s*(?!['"]['"])/.test(text)) hits.push(`${rel}: innerHTML`)
+      // 空白放进前瞻里，避免 \s* 回退到空格前面、把 innerHTML = '' 误判成写入。
+      if (/innerHTML\s*=(?!\s*['"]['"])/.test(text)) hits.push(`${rel}: innerHTML`)
     }
     expect(hits).toEqual([])
   })