fix: sanitize terminal control characters in agent output

[arvid-berndtsson]

Summary

• Strip terminal control bytes from agent-mode TOON output after encoding.
• Preserve TOON structural newlines and escaped string controls.

Verification

• npm test: 16 passed using the existing @toon-format/toon 0.8.0 dependency.
• npm run typecheck passed.
• git diff --check passed.

OAuth/API-base safeguards are kept in the separate local worktree for follow-up.

[arvid-berndtsson]

Hi, if there are any questions regarding my suggestions please feel free to ask. 😊

It would be nice to get these two things fixed.

[waltonseymour]

Thank you for the contribution @arvid-berndtsson !

The terminal control character changes look good to merge.

I think we might want to add additional safeguards for modified API_BASE values. This prevents against sending a cached token to a modified base, but still will result in a token request with stored credentials being sent to said base.

[arvid-berndtsson]

Hi @waltonseymour! I’ve split the original PR into separate changes to make them easier to review. PR #16 now contains only the terminal-output sanitization changes you said looked good. I’ve kept the API_BASE/OAuth safeguards separate as follow-up work.

Please let me know if you’d like any other changes to this PR.

One note: this change sanitizes agent-mode response output; it doesn’t cover every CLI stdout/stderr path, such as downloaded media, dry-run details, or verbose/error messages. I’ve kept those paths out of this PR’s scope.