security: remediate deep scan findings - #212

Summary

• remediates 3 high, 12 medium, and 11 low findings from the Codex Security deep scan
• hardens delegated Git execution, cleanup workflows, persistence parsing, path handling, terminal observations, and tool installation
• adds bounded output/workspace abstractions, Unicode-safe file display, resource limits, and regression coverage
• updates conformance inventory and immutable evidence hashes

Validation

• dotnet test TuiVision.sln --configuration Release --no-restore: 1071/1071 passed
• focused security and maintenance suite: 83 passed, 9 platform-specific skipped
• dotnet format TuiVision.sln --verify-no-changes --no-restore
• Bash syntax, PowerShell parser, JSON validation, and git diff --check
• pre-push tracked-file secret scan passed

Follow-up validation

A Codex Security diff scan will be run against this published PR.