quoteUntrusted() does not strip HTML tags, Unicode bidi overrides, or horizontal rules

## Summary

`quoteUntrusted()` in `packages/mcp-shared/src/tools.ts` (L160-168) strips headings and blockquotes from server-controlled text before rendering in approval prompts, but does not strip HTML tags, Unicode bidirectional override characters, horizontal rules, or strikethrough markers.

## Affected Code

`defuseFences` only replaces triple backticks. `quoteUntrusted` strips `#` and `>` at line starts but nothing else.

## Missing Sanitization

| Pattern | Example | Effect |
|---------|---------|--------|
| HTML tags | ``, `` | Injected markup in rendered Markdown |
| Unicode bidi | U+202E (RTL override) | Visually reverses text direction, misleading the approver |
| Horizontal rules | `---` or `***` at line start | Breaks visual structure of the prompt |
| Strikethrough | `~~important warning~~` | Crosses out safety-relevant text |

## Impact

A malicious MCP server can craft tool descriptions that include these patterns. Since the descriptions are rendered as Markdown in the Workshop chat transcript (ChatInterface.tsx uses ReactMarkdown with remarkGfm), the injected formatting can mislead the user about what a tool does.

This complements the existing issue #42 (two of the three approval-queue descriptions skip sanitizers entirely).

## Suggested Fix

Add stripping for the missing patterns in `quoteUntrusted()`:
- Strip HTML tags via regex
- Strip Unicode bidi control characters (U+200E-200F, U+202A-202E, U+2066-2069, U+061C)
- Strip horizontal rules (`---`/`***`) at line starts
- Strip strikethrough markers (`~~`)

Previously submitted as part of PR #66 (closed per contributing guidelines).

Start in packages/mcp-shared/src/tools.ts at quoteUntrusted() and review how its defuseFences handling reaches the Markdown rendered by ChatInterface.tsx with ReactMarkdown and remarkGfm. Add focused coverage for the listed HTML, bidi, horizontal-rule, and strikethrough inputs; done means those patterns no longer alter approval-prompt formatting while ordinary text remains readable.

Written by the indexing model from the issue text.