fix: sanitize hidden terminal strings in web evidence

[outlier27-cell]

Problem

Fixes #700.

Value

This is an evidence-backed source-boundary fix with deterministic regressions; malformed input no longer becomes a misleading successful projection.

Approach

Require the existing canonical types and limits at the Web boundary. Add regression tests that fail on origin/main and pass after the fix. See the linked docs/research record in this branch.

Validation

• Targeted regression tests pass after failing on origin/main.
• bun run check passed.
• Full local bun run test was interrupted during machine-wide Windows resource contention; no full local pass is claimed. CI is the authoritative full matrix.

Impact

Existing valid behavior is preserved. Malformed evidence/configuration is rejected or remains unknown. No provider, Session, or orchestration surface is added.

[outlier27-cell]

@tt-a1i 请审核此 PR。最新提交已通过完整 GitHub CI，当前可合并；如有需要调整的地方，我会在原分支及时修复。