test(core): unit-test the shared Unicode sanitizer

[rekcilyssup]

Summary

packages/core/src/text-sanitize.ts is the single source of truth (#1404) for the Unicode sanitize pipeline shared by session names (session-name.ts) and foreign-session names (foreign-session.ts) — explicitly documented as security-adjacent (bidi-spoofing defense) shared infrastructure — but it had no direct unit tests; only callers exercised it transitively.

This adds direct coverage of each pipeline stage and edge:

• NFC normalization — decomposed macOS filenames compose to match.
• Control characters → replaced with single spaces (multi-line input stays readable).
• Bidi format characters (ALM/LRM/RLM/LRE…PDI) → replaced with spaces so direction spoofing collapses.
• Zero-width characters → removed entirely; includes a compound-emoji case showing code points stay intact.
• Whitespace collapse + trim, code-point capping without splitting surrogate pairs, silent caps via empty suffix, and inputs that sanitize to empty.

Character classes are asserted via \uXXXX escapes in both source and test, per the note in text-sanitize.ts about keeping files text-safe for git.

No production code is touched.

Verification

• New suite passes (node --test packages/core/dist/__tests__/text-sanitize.test.js).
• Full @maka/core suite: 660 tests, 660 pass.
• npx biome check packages/core/src clean; ASF header check passes.

AI use

Select exactly one:

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: opencode — identified the coverage gap, wrote the tests against the documented pipeline, hand-checked expectations against the implementation. Commit carries the Generated-By: opencode trailer.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• No