fix(mcp): ANSI/control-char terminal sanitization is applied to exactly one output path, not the others that also print third-party text

[JSONbored]

Context

sanitizePlainTextTerminalOutput (packages/loopover-mcp/bin/loopover-mcp.js:2110-2114) strips ANSI escapes and control characters before printing, but its only call site is validateConfigCli's warning loop (line 2148). Every other command that prints server- or third-party-controlled free text straight to the terminal does NOT use it: slopRiskCli/issueSlopCli's finding.title/finding.detail (2208, 2241), decisionPackCli/repoDecisionCli's payload.summary/rerunGuidance/actions (2266-2299), maintainCli's action.reason (1835-1850), and doctor()'s check.detail. No comment explains why the scope is narrow.

Requirements

• Apply sanitizePlainTextTerminalOutput to every other named output path above that prints server/third-party-controlled text to the terminal.
• Do not change the already-sanitized validateConfigCli path.
• If any of the listed fields is confirmed to never contain attacker-influenceable content (verify, don't assume), it's fine to skip that one specifically — but note the reasoning in the PR rather than silently leaving it unsanitized.

Test Coverage Requirements

Match this package's existing test conventions; add a regression test per newly-sanitized call site confirming ANSI/control-char injection in the relevant field doesn't reach raw terminal output.

Deliverables

• All named output paths sanitize their printed text consistently with validateConfigCli.

Expected Outcome

Terminal-escape-sequence injection via a malicious API response or finding text can't manipulate the user's terminal through any of these commands, matching the protection validateConfigCli already has.

Links & Resources

• packages/loopover-mcp/bin/loopover-mcp.js:2110-2114,2148,2208,2241,2266-2299,1835-1850

[linear-code]

JSO-4345