[P3][cli] Sanitize CLI get/scan output against terminal escape injection

[cevheri]

Summary

CLI get/scan print raw bytes to terminal. Untrusted binary values can inject ANSI escape sequences (terminal control / social engineering).

Audit ID: Section 4 Low — Wave 3
Location: src/cli/run.ts:125

Fix

• Default: hex-encode non-printable bytes or use JSON.stringify on UTF-8 safe subset.
• Flag --raw for power users who want literal output.

Acceptance criteria

• Safe default output for untrusted data.
• Test with \x1b sequence in value.
• Changeset (CLI UX).

[cevheri]

Implemented and shipped in PR #43 (merge commit 69f7161), released as v0.2.0. The PR description's comma-separated Closes list only auto-closed the first reference — closing manually. For #39/#28-style partials: the shipped scope is done; the real-browser verification half of #39 continues under #10, and the typed-error contract (#28) shipped as LibreDbError with stable codes across kernel, adapters, lenses, and CLI.