Adversarial input validation for agent-generated commands

[vdemeester]

Summary

AI agents make different mistakes than humans — they may generate inputs containing path traversal sequences, embedded query parameters, URL encoding, or control characters. The CLI should validate and reject malformed inputs at the CLI boundary before they reach the Kubernetes API.

Proposal

• Implement path canonicalization and sandbox validation for file arguments
• Reject resource IDs containing query params (?, #) or URL encoding (%)
• Filter non-printable ASCII control characters from all inputs
• Add --sanitize flag for defensive filtering of API responses (prompt injection defense)

Acceptance Criteria

• File path arguments are canonicalized and validated against path traversal
• Resource names/IDs reject ?, #, %-encoded characters
• Control characters (non-printable ASCII) stripped from inputs
• --sanitize flag available to sanitize API response content

Context

Part of #2849 — making tkn agent-friendly.

/kind feature