sec(cli): shell_escape missing null byte and newline rejection

[cluster2600]

Summary

The shell_escape() functions in the CLI (crates/openshell-cli/src/run.rs, line 1787) and core (crates/openshell-core/src/forward.rs, line 474) use single-quote wrapping but do not reject null bytes or newlines.

In contrast, the server-side shell_escape() at crates/openshell-server/src/grpc.rs:3493 correctly rejects these characters via reject_control_chars().

A null byte can truncate a C-level shell parse, and newlines can break out of a single-quoted context when the command traverses multiple interpretation layers (e.g., SSH remote shell + bash -lc).

Impact

• Severity: Medium
• The CLI's shell_escape is used in ProxyCommand construction (ssh.rs:117-122), doctor_exec (run.rs:1664-1665), and sync commands (ssh.rs:474-476, 544-545, 613-623).

Proposed Fix

Add null byte, newline, and carriage return rejection to both shell_escape functions, matching the server's stricter implementation. Return Result<String, ...> instead of String and propagate the error.

Note: This is related to #556 (structured protocol) but is a narrower, independently fixable issue.

[johntmyers]

Security triage determination: No-go (local robustness issue, not a core boundary break).

The mismatch with stricter server-side escaping is noted, but this does not presently show a practical compromise of core trust boundaries. Most impact is in local command composition paths where the user/operator already controls inputs or has equivalent execution capability.

This is better tracked as CLI robustness hardening, not a security vulnerability affecting core channel security.