Harden verify-work checkpoint rendering

tests/security.test.cjs

@@ -14,6 +14,7 @@ const {
   requireSafePath,
   scanForInjection,
   sanitizeForPrompt,
+  sanitizeForDisplay,
   safeJsonParse,
   validatePhaseNumber,
   validateFieldName,
@@ -244,6 +245,19 @@ describe('sanitizeForPrompt', () => {
   });
 });
 
+describe('sanitizeForDisplay', () => {
+  test('removes protocol leak lines', () => {
+    const input = 'Visible line\nuser to=all:final code something bad\nAnother line';
+    const result = sanitizeForDisplay(input);
+    assert.equal(result, 'Visible line\nAnother line');
+  });
+
+  test('keeps normal user-facing copy intact', () => {
+    const input = 'Type `pass` or describe what\\\'s wrong.';
+    assert.equal(sanitizeForDisplay(input), input);
+  });
+});
+
 // ─── Shell Safety ───────────────────────────────────────────────────────────
 
 describe('validateShellArg', () => {