`saxen` doesn't decode character references (`é`, `&`, etc) itself:
it passes a `decodeEntities()` function to its `text` / `openTag` handlers
for the consumer to call, and `parseXmlStream.saxen.js` never called it.

On top of that, the copy-pasted `saxen` wrapper in `saxen/parser.js` had
`return Parser(options)` at the top of the function body, so the top-level
`var` initializers below it (`ENTITY_PATTERN`, `ENTITY_MAPPING`, etc) never
ran — hoisting made the functions available but left the variables
`undefined`, turning `decodeEntities()` into a silent no-op
(`s.replace(undefined, ...)` matches nothing). The `return` was moved to
the bottom, mirroring `parseXmlStream.saxen.code.js` which already had it
in the right place.

This is a regression introduced in `9.3.0` by the migration from the DOM
parser (which decoded character references natively) to the SAX parser.
It affects any file whose XML escapes characters as references — e.g.
`openpyxl` escapes all non-ASCII text (`é` → `é`) — as well as
sheet names and other attribute values containing `&`, `<`, `"`, etc.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FBbGKM9Kt8imm9H7nysqjb

Fix XML character references not being decoded in cell values and attributes (regression in 9.3.0)

See merge request !10