[CrypticSwarm]

Stacked on #92 (GPU support for tongs): this PR also escapes the approval prompt's new gpus: line. Merge #92 first; GitHub will then retarget this PR to master.

Problem

The first-run approval gate shows what a workspace-sourced tong asks for (image, secret references, mounts, networks, docker socket, GPUs) before asking y/N. Those values come straight from a definition in a repo you cloned. The YAML reader passes raw control bytes through, and the gate runs before schema validation, so even a value validation would later reject reached the terminal unescaped. A crafted value could move the cursor, erase lines, or switch on concealed text, and so hide a grant such as the docker socket or a secret reference from the person approving it. A secret reference placed under an unknown key is enough: validation tolerates unknown keys and the summary scans the whole definition. This was already the case on master; a review of the GPU work found it.

What changes

• tongs.printable(text) (swarmforge/tongs/model.py): replaces every character str.isprintable() rejects with its Python escape (\x1b, \n, ‮). That covers C0 and C1 controls, DEL, bidi overrides, zero-width/format characters, and non-ASCII spaces. Ordinary text, including non-ASCII letters, prints unchanged, so a normal prompt looks exactly as before.
• Approval summary: render_privilege_summary escapes each finished line before joining them, so the summary keeps its own line structure and any line added later is covered without anyone remembering to wrap it. The y/N question and the denial messages already render the tong name with %r, which escapes the same set.
• Skipped-tong warning: discovery prints a bad file's path before the gate runs, and a workspace file name could switch on a terminal mode that hides what follows. That warning now goes through printable too.
• Docs: docs/tongs/approval.md says values are shown with control and formatting characters escaped.

What is guaranteed: nothing the prompt prints from a definition can move the cursor, restyle the text, break a line, or reverse the text direction. Lookalike characters Python counts as printable (blank Hangul fillers, combining overlays) pass through unchanged. They can't hide a grant: each grant has its own fixed label line, and approval is keyed to the hash of the exact definition. Backslashes are left alone, so ordinary values look the same.

Testing

• make test: 959 tests pass. ruff check is clean.
• Tests check that an escape sequence in every rendered field (image, secret provider/ref including one under an unknown key, mounts, networks, gpus) comes out escaped and that a newline cannot forge a line. They also check that the socket line still appears, that plain and non-ASCII values render unchanged, and that the discovery warning is escaped. Removing the escaping fails 5 approval tests and the discovery test.
• During review, every non-printable code point was pushed through each rendered field, and hostile file names were tried end to end through bin/run-anvil. Nothing reached the terminal unescaped before the y/N answer.

Not in this PR

• Output printed before the launcher starts (the Makefile's set -x echo, git-guard warnings) is still raw.
• A few warnings after the gate print the tong name with '%s'; that name comes from a trusted layer or a file name.