Directory completion fail to handle special characters.

`fish --version`: fish, version 4.7.1
`uname -a`: Linux ga 7.0.10-zen1-1-zen #1 ZEN SMP PREEMPT_DYNAMIC Sat, 23 May 2026 14:45:01 +0000 x86_64 GNU/Linux

Test after `sh -c 'env HOME=$(mktemp -d) XDG_CONFIG_HOME= XDG_DATA_DIRS= fish'`

reproduce
```fish
mkdir b1 b\ 2 b\n3 b\t4
ls
# get: 'b'$'\t''4'/ 'b'$'\n''3'/ 'b 2'/ b1/
cd b#
# show: b (4/) b␤3/ b 2/ b1/
sudo ls #
# show: 3/ b (4/) b 2/ b1/
sudo ls b#
# show: b (4/) b 2/ b1/
```
This looks like a bug inside `complete`, and I worry it will bring about other issues.

This issue was discovered while I was testing edge cases in my own C code.