v1.0.7 — security: terminal escape injection fix

Security release (CWE-150): neutralizes terminal escape-sequence injection from attacker-controllable item text across all prompts + createFormatter. See CHANGELOG. Published with npm provenance via OIDC Trusted Publishing.

v1.0.6

First open-source release, published with npm provenance via OIDC Trusted Publishing. No runtime code changes since 1.0.5.