Bound download expansion and escape control chars on the terminal (closes #164)

Objects fetched from the store are untrusted; several decode paths let one
expand or print without limit.

- blobgen.LimitReader errors past a byte cap (not io.LimitReader's silent
  EOF). DecodeManifest reads through caps on both compressed input and
  decompressed output, far above any real manifest, so json.Decode cannot
  buffer a compressible bomb. FetchAndDecryptBlob bounds decompression to
  the blob's recorded uncompressed_size (not the restoring host's
  blob_size_limit).
- downloadSnapshotDB streams straight from storage to its temp file with
  io.Copy, replacing two ReadAll calls that held the whole database twice.
- FetchBlob drops the per-blob Stat round-trip, its expectedSize parameter
  and returned size, all of which only fed a debug log.
- TTYHandler and ui.Writer escape control characters in messages,
  attribute keys/values, and rendered identifiers/paths before colour
  codes are applied, so a crafted value cannot drive the terminal.

Model: opus-4-8

internal/ui/ui_escape_test.go

@@ -0,0 +1,32 @@
+package ui_test
+
+import (
+	"strings"
+	"testing"
+)
+
+// TestValueFormattersEscapeControlCharacters checks that a path carrying an
+// ESC and a newline — the shape a symlink target read back from the
+// snapshot database could take — is escaped before it reaches the output.
+// Colour is off here, so the only way a control byte could appear is from
+// the value itself.
+func TestValueFormattersEscapeControlCharacters(t *testing.T) {
+	t.Parallel()
+
+	w, buf := newTestWriter(false)
+	w.Infof("restoring %s", w.Path("a\x1b[31mZAP\nb"))
+
+	out := buf.String()
+
+	if strings.ContainsRune(out, '\x1b') {
+		t.Fatalf("raw ESC from a value survived in output: %q", out)
+	}
+
+	if strings.Count(out, "\n") != 1 {
+		t.Fatalf("a newline in a value must be escaped, not emitted raw: %q", out)
+	}
+
+	if !strings.Contains(out, `\x1b`) {
+		t.Fatalf("expected the escaped form of ESC in output: %q", out)
+	}
+}