Harden the brain stage against malformed and oversized replies

[jamditis]

Problem

Both brain paths trust their output. pipeline.brain returns result.stdout.strip() from claude -p unbounded; brain_via_bridge returns the polled payload from _last_delivery as-is. A very long reply, control characters, or markdown will be handed straight to Piper, and an empty reply produces silent or broken speech.

Why it matters

The reply is spoken aloud, so unbounded or malformed text becomes a broken or endless utterance. The transcript is also untrusted spoken input driving the prompt.

Approach

Add a sanitize_reply() applied to both brain paths before speak: cap length, strip control characters and markdown that the VOICE_SYSTEM_PROMPT already asks the model to avoid, and on an empty reply substitute a short spoken fallback. Confirm the existing ssh_cli_send shell-quoting of the untrusted prompt stays intact (it uses shlex.quote). Keep the spoken error strings already returned on timeout/transport failure.

Acceptance criteria

• Replies are length-capped and stripped of control characters before TTS
• An empty reply yields a short spoken fallback rather than silence
• Both pipeline.brain and brain_via_bridge outputs pass through the sanitizer
• A test covers oversized, empty, and markdown-laden replies

[jamditis]

PR #75 implements this and closes it. All four ACs met:

• Length-capped (600) and control characters stripped before TTS
• Empty reply yields a spoken fallback rather than silence
• Both backends route through sanitize_reply() at brain()s return, one choke point rather than a guard per backend
• test_sanitize_reply.py, 40 checks, covering oversized, empty, and markdown-laden replies

ssh_cli_sends shlex.quote verified intact (brain_bridge.py:244,278), so the transport half holds.

Review surfaced three cases the naive version of each guard gets wrong, each now pinned by a test: dropping only the ESC byte speaks [31m aloud; stripping every */_ mangles BOT_SPREN_STATE_DIR, *.py, and 5 * 6; and matching only complete fences speaks the code of a truncated one. Also fixed a real truncation bug found in review: _truncate_spoken returned on the first delimiter kind that cleared the halfway mark rather than the latest sentence end, silently dropping up to 40% of speakable text on mixed punctuation.

Deferred to #74: a fenced block holding plain prose is dropped rather than unwrapped. That needs a prose-vs-code heuristic, larger than this issue scoped, and the current default is the safe side of the tradeoff.

wake-20260716T1705-46da79