Address review feedback: sanitize manager.flags values to allow only CLI-safe tokens (--flag patterns and alphanumeric values). Invalid tokens are dropped with a stderr warning. Prevents prompt injection via compromised config.json. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>