evidence_field diagnostic prints attacker-controlled JSON key names unescaped (terminal escape hygiene) #378

Problem

In the evidence diagnostic attribution shipped in #376, cortex qa run prints the failing evidence field name to stderr unescaped:

evidence_field=%s evidence_reason=%s\n

The field value for unknown_field rejections comes from an attacker-controlled JSON key name in the --evidence payload. A payload with a key containing ANSI terminal escape sequences (or control characters) would have those bytes printed verbatim to the operator's terminal, and any tooling that ingests the stderr stream sees unsanitized attacker-controlled bytes. The evidence_detail lines are mostly safe because they use %q, but evidence_field does not escape.

Severity is low: the affected stream is the caller's own stderr and there is no code execution or privilege path. It is a log/terminal hygiene gap in fail-closed diagnostics, the same class of concern as issue #305 (frame directives).

Expected outcome

• evidence_field output is restricted to a safe charset (or escaped via %q), so JSON key names cannot inject control or escape sequences into stderr.
• The same rule applies to any future diagnostic fields derived from caller-supplied input.
• One test proving an evidence file with a control-character key name produces a sanitized stderr line and no raw escape bytes.

Affected scope

internal/cli/doctor.go (runQA evidence diagnostic printing) and possibly the EvidenceValidationError.Error() path in internal/qapi/evidence.go.

Refs #376, #305, #375.