Hang-guard record identity + XML DOCTYPE/entity bypass

Fixed record identity lookup that misread Tally keys and added XML DOCTYPE/entity parsing guards to prevent bypass attacks.