pub fn escape(s: &str) -> Result<String, Error>
Escape text/attribute content, including CR so it survives XML newline normalization.