fix(#24): redact marker must have no shell metacharacters

[aict666]

Problem

Claude Code v2.1.114 (Opus 4.7) routed through the proxy still derails on tool use — not because of the old preamble (PR #51 fixed that), but because the model echoes the redaction marker (internal path redacted) into a bash tool call:

⏺ Bash(cd (internal path redacted) && git branch -a && git log --all --oneline -30)
  ⏎ Error: Exit code 1
     (eval):1: unknown file attribute: i

zsh parses cd word(qualifier) as glob-qualifier syntax, reads the i of internal as a qualifier flag, and dies with the cryptic unknown file attribute: i. The model can't recover from that error shape and starts replying with confused meta-text ("the user seems to have pasted a system prompt along with a shell error...") instead of retrying the tool.

Root cause

Commit 9120b8b picked (internal path redacted) with the rationale "a multi-word parenthesised phrase cannot be tokenised as a path or identifier." True for file APIs — but parens are first-class shell metacharacters (subshell in POSIX sh/bash, glob qualifier in zsh). The marker has to satisfy file-API safety AND shell safety AND anti-loop shape simultaneously; the old marker only cleared the first two.

Fix

Drop every shell metacharacter from the marker. Use a plain ASCII multi-word phrase:

const REDACTED_PATH = 'redacted internal path';

• No character in ()[]{}<>|&;$`"'\*? → no shell parser treats it specially.
• No /, no . → does not look like a path, so the sonnet/opus drift-probe regressions (./tail, [internal], <redacted-path>) do not come back.
• Contains whitespace, multi-word → cannot be tokenised as a single identifier / file_path argument.
• If a model still inlines it in shell, the words split into separate argv entries and cd / Read fails with a clean recoverable error (cd: too many arguments, single ENOENT) — never the cryptic glob-qualifier error.

No other changes: the patterns, the streaming cut-point logic, and the sanitizeToolCall shape are untouched.

Regression guard

Adds a new suite REDACTED_PATH marker shape (shell-safety regression) with two asserts:

1. No shell metacharacters. The marker must not match /[()\[\]{}<>|&;$`\\"'*?]/.
2. Not a path or identifier. No /, no \\, contains whitespace, multi-word.

Both guards run against the actual output of sanitizeText('/tmp/windsurf-workspace'), so any future marker change must pass them or break the build.

Tests

npm test — 61/61 pass (59 existing + 2 new marker-shape guards).

Risk

Low. Only the display string changes. All 19 call sites pass the string through opaquely; none parse or pattern-match on the marker value. Clients that previously rendered (internal path redacted) in transcripts will now render redacted internal path — the information conveyed is identical and the wording reads as prose in both English and CJK contexts.