- Add internal/validate with control char rejection, ANSI stripping,
URL query/fragment stripping, and terminal sanitization
- Refactor output/sanitize.go to delegate to validate package
- Update sanitize test to reflect ANSI escape stripping behavior