Security: Sanitize service names in deploy progress output (ANSI injection)

[jongio]

Context

Follow-up from PR #7776 (exegraph) review - wbreza Pass 3, finding L7.

Problem

Service names from azure.yaml are passed to fmt.Sprintf in deploy_progress.go without sanitization. A malicious azure.yaml config could embed ANSI escape sequences in service names to manipulate terminal output.

Risk Assessment

LOW - requires the user to have a malicious azure.yaml in their own project directory. Not exploitable remotely.

Acceptance Criteria

• Sanitize service names in deploy progress table rendering (strip non-printable / ANSI escape sequences)
• Or document as accepted risk and close

Related

• PR feat(exegraph): graph-driven execution engine for up/provision/deploy #7776 (exegraph engine)