echo: false is ignored for {ojs} cells in docx/pdf output, exposing source code

Description

An {ojs} cell with echo: false correctly hides its source in HTML, but in
docx and pdf — where OJS cannot execute — Quarto writes the cell's raw
JavaScript source into the document body as visible text, ignoring echo: false.
The OJS docs state echo controls whether OJS cells display their source and that
echo: false means "do not include source code in output", so this is an
expectation-vs-actual mismatch. The only current avoidance is manually wrapping
every OJS cell in ::: {.content-visible when-format="html"}.

Steps to reproduce (minimal)

cat > doc.qmd <<'QMD'
---
title: OJS echo test
format:
  docx: default
  pdf: default
---

Intro paragraph.

```{ojs}
//| echo: false
ojsEchoFalseToken = 41 + 1
```

Outro paragraph.
QMD

quarto render doc.qmd --to docx
unzip -p doc.docx word/document.xml | grep ojsEchoFalseToken   # -> match (leaked)

quarto render doc.qmd --to pdf
pdftotext doc.pdf - | grep ojsEchoFalseToken                   # -> match (leaked)

Both greps return a match on Quarto 1.9.37 (docx and pdf each contain the source).

Expected

With echo: false, the OJS source is not shown. In formats where OJS cannot run,
the cell should be omitted (consistent with echo: false), not echoed as source.

Actual

The source ojsEchoFalseToken = 41 + 1 appears in both the .docx body and the
rendered PDF, despite echo: false.

Impact

Any document that uses OJS for interactive HTML figures and also exports to
Word/PDF leaks JavaScript source into the print outputs unless the author wraps
every OJS cell in a when-format="html" div. echo: false reads as suppressing
the code but does not in these formats.

Suggested fix

Honor echo: false for {ojs} cells in all formats, or — for formats where OJS
cannot execute — omit the cell by default rather than echoing its source.

Environment

Quarto      1.9.37
Pandoc      3.8.3
OS          macOS 26.5.1 (arm64)

Reported by: Miriam Marling · miriam@bonquery.ca