pub fn sanitize(value: &str, maximum: usize) -> String
Preserve LF/tab, remove terminal/format controls, and truncate at UTF-8 boundaries.