HS: fix CSS query template tokenization — <${...}/> treated as selector

Add '$' to the set of characters that trigger selector tokenization after
'<'. Previously only letters, '.', '#', '[', '*', ':' were recognized.
Now <${"expr"}/> is emitted as a single selector token instead of being
split into op/<brace-open/string/brace-close/op/op tokens that caused the
parser to spiral through comparison-expression parsing (>30s timeout).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

lib/hyperscript/tokenizer.sx

@@ -538,7 +538,8 @@
                     (= (hs-peek 1) "#")
                     (= (hs-peek 1) "[")
                     (= (hs-peek 1) "*")
-                    (= (hs-peek 1) ":")))
+                    (= (hs-peek 1) ":")
+                    (= (hs-peek 1) "$")))
                 (do (hs-emit! "selector" (read-selector) start) (scan!))
                 (and (= ch ".") (< (+ pos 1) src-len) (= (hs-peek 1) "."))
                 (do (hs-emit! "op" ".." start) (hs-advance! 2) (scan!))