feat(core): scrub leaked tool-call wire-format at the capture boundary

[widgetii]

Problem

kaeru is an MCP server; its callers are arbitrary LLMs and it has no
control over how a model formats a tool call. A malformed call can spill
the invocation envelope — the parameter open/close tags, an invoke
wrapper — into a string argument (name / body), and kaeru stored it
verbatim. Observed in the field: a cite body ended with
…not a firmware toggle.</body>\n<parameter name="initiative">rack, and
because the initiative collapsed into the body text the node also
landed un-scoped.

Treating whatever arrives as trusted is the server's bug, not the
caller's.

Fix

New kaeru_core::sanitize::strip_tool_call_markup removes a leaked
envelope at the write boundary. It is deliberately narrow — keyed
to the specific tool-call markers (matching both plain and
antml:-namespaced spellings), never angle-bracket markup in general —
so legitimate content survives untouched: code (Vec<u8>), XML/HTML
snippets, even a literal </body> in prose. High precision: it only
fires on an actual leak.

Applied inside the write primitives — cite, write_episode, jot,
improve — so every adapter (MCP, rig, cloud ingest) gets clean
storage, not just one. The MCP capture/revise handlers add a
(note: stripped leaked tool-call markup from …) line so the caller is
told sanitization happened (policy: strip + flag, not silent, not reject).

Tests

• Sanitizer units: observed leak, namespaced form, bare trailing close
  tag, wholly-envelope → empty, and legitimate-markup preservation
  (code / comparisons / HTML-ish tags pass through unchanged).
• cite wiring test: a dirty body is stored scrubbed.

kaeru-core 140 green, kaeru-mcp 20 green. Independent of #61/#62 (no
substrate/schema change).

🤖 Generated with Claude Code