fix(terminal): reject control characters in dropped paths

[herikwebb]

Files from an opened workspace can contain line breaks or other terminal control characters in their names. Dropping them onto a terminal can turn those characters into input actions. This change skips those paths and shows a warning, while continuing to insert the other files in the drop.

Closes #516.

Technical changes

• Reject C0, DEL, and C1 characters at the shared paste boundary used by file-browser drops and uploaded server paths, before mention or raw formatting.
• Reject the entire path rather than rewriting its filename. Show only the rejected count, and avoid paste/focus calls for an all-rejected batch.
• Preserve ordinary Unicode filenames, quoting, path order, toolbar selection, Shift inversion, upload-error handling, and disposal behavior.
• Add regression tests for every rejected code point, line breaks and escape sequences, both drop sources, mixed batches, mode combinations, failed uploads, and uploads completing after terminal disposal.
• Document skipped paths and intended mention/raw usage; add an Unreleased changelog entry.

Validation

Tested on macOS with Python 3.12 against upstream cfb130130af90b51abd9ae22c4c19783acef7b84:

• pytest tests/ -q: 2,258 passed; one event-loop teardown warning.
• jlpm tsc --noEmit: passed.
• jlpm lint:check: passed.
• jlpm jest: 54 suites and 724 tests passed, including 102 terminal-drop tests.
• git diff --check: passed.

The frontend tests exercise DOM drop handlers with mocked terminal and upload boundaries; no live terminal UI session was exercised. Mention mode remains intended for an agent accepting @ paths, and raw mode provides POSIX shell quoting. This guard does not make mention syntax safe for arbitrary shell commands.