fix: address PR review feedback for JSON fallback

- Simplify escapeXml() using 'str == null' check (type narrowing)
- Add validation for extracted JSON before passing to specToXml()
- Prevents runtime errors when JSON doesn't match SpecOutput schema

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

apps/server/src/lib/app-spec-format.ts

@@ -14,10 +14,10 @@ export { specOutputSchema } from '@automaker/types';
  * Handles undefined/null values by converting them to empty strings
  */
 function escapeXml(str: string | undefined | null): string {
-  if (str === undefined || str === null) {
+  if (str == null) {
     return '';
   }
-  return String(str)
+  return str
     .replace(/&/g, '&')
     .replace(/</g, '&lt;')
     .replace(/>/g, '&gt;')