chore: share the escaping helpers and collapse the ai-gateway twins

[chubes4]

The sibling finding to #603. That audit asked which mechanisms have no consumer; this one asks which have two bodies.

The drift that had already happened

Escaping was written three times. Two of the JSON escapers were identical:

value=${value//\\/\\\\}
value=${value//\"/\\\"}
value=${value//$'\n'/\\n}

The third, in lib/agent-state-ownership.sh, was not:

printf '%s' "$1" | sed -e 's/\\/\\\\/g' -e 's/"/\\"/g'

No newline handling. A value containing a newline emits a literal newline inside a JSON string literal, which is invalid JSON — and that copy's output is the machine-read {"status":"root_repair_required",...} record. Nothing exercised the newline case, which is exactly why the divergence survived: there was no test, and nobody knew there were three implementations to compare.

XML text escaping was triplicated across the kimaki bridge and both launchd services — still identical, waiting to do the same thing to a plist.

This is the shape #601 predicted. Short helpers feel harmless to re-type, so they get copied instead of shared, and then one copy gets a fix the others never see.

What changed

json_escape and xml_escape now live in lib/common.sh, one implementation each, with six local copies deleted and every call site rewritten. Escaping is precisely the code that must exist once: short enough to feel trivial, consequential enough that a divergence is a correctness bug rather than a style difference.

xml_escape deliberately handles & < > and not quotes — text nodes need those three, and " inside a plist <string> is six literal characters, not a quote. That reasoning is now written down once instead of implied three times.

setup_ai_gateway and upgrade_ai_gateway had byte-identical bodies. Two names for one behaviour reads as "these differ somehow" to anyone who hasn't diffed them. Now one ai_gateway_apply, called from both.

The check

tests/duplicate-mechanism.sh, wired into CI, comparing normalised bodies (comments and blank lines stripped, lines trimmed) with a four-line floor so trivial accessors stay out of it.

Exact matches only. Near-duplicates are a judgement call, and a checker that makes judgement calls gets argued with rather than fixed. ALLOWED exists for deliberate pairs and is empty.

compared 576 production function bodies (>=4 lines) across 51 files

no duplicated mechanisms

Verification

tests/escaping-helpers.sh — 14 assertions covering both helpers, including JSON round-trips through python3 -c json.loads, the backslash-before-quote ordering that every JSON escaper gets wrong eventually, and the previously-divergent consumer now emitting parseable JSON.

The test earns its place: swapping the pre-consolidation escaper back in makes exactly the right three fail.

--- with the pre-consolidation divergent escaper:
FAIL escapes a newline
FAIL a newline survives a JSON round-trip
FAIL agent-state path list parses as JSON
11 passed, 3 failed

--- with the shared helper:
14 passed, 0 failed

Full suite on Linux: 73 pass, 4 fail — the same 4 that fail on a pristine main clone on the same host, for environmental reasons (/tmp world-writable, wp present so it resolves absolute). datamachine-worker is one of them and I edited that file, so I diffed its failure against main's: byte-identical, and unrelated to escaping.

tests/ci-coverage.sh passes with all three new jobs wired. bash -n clean across every .sh. Both hygiene checks from #603 still report clean.

---

AI assistance: audited and implemented by Claude Opus 4.5 via Claude Code, driven by Chris. The model wrote a normalised-body similarity audit to choose the target, found the JSON escaper drift, consolidated the copies, and verified the new test fails against the old implementation before trusting it.