- Add internal/validate with control char rejection, ANSI stripping, URL query/fragment stripping, and terminal sanitization - Refactor output/sanitize.go to delegate to validate package - Update sanitize test to reflect ANSI escape stripping behavior