v0.5.2 — sanitize untrusted manifest content

Security hardening — the kit's job is scanning an untrusted target repo, so this closes the content-injection sibling of the RCE vector already fixed in v0.4.x.

Security

• Untrusted manifest content is now sanitized before it is embedded in a generated agent. A target repo's package.json name (or a Cargo.toml / pyproject.toml field, or a script command) previously flowed verbatim into the rendered <stack>-architect body — a crafted name like app](http://evil) **SYSTEM: …** landed as live markdown / a link / a prompt-injection string inside an agent definition a user later loads. render.sh now strips control chars + newlines (no multi-line / YAML-key breakout) and the markdown-structural chars (` []()<>{}|*#) from these untrusted scalars, and caps length. YAML frontmatter was already safe (the name key uses the fixed stack slug, never the untrusted string); this neutralizes the agent body too. languages / frameworks / store come from detect.sh's fixed vocabulary and were never a vector.

New render_test.sh case [12] proves the payload is neutralized and the frontmatter stays valid YAML. Full suite: 175 passed, 0 failed; shellcheck clean; claude plugin validate --strict passes.

Full changelog: https://github.com/jhlee0409/claude-harness-kit/blob/main/CHANGELOG.md