Sanitization requires color, which parses every record

Problem

With styling disabled, AutoStream still walks every record through anstyle-parse's VT state machine, roughly doubling per-record cost even for builds emitting no styling.

Target::Stderr → /dev/null, 161-byte records, 500k iterations, release + LTO, 8 interleaved rounds:

Turning off just auto-color doesn't avoid it — WriteStyle::Auto then collapses to Never (src/writer/mod.rs:134), making the parse unconditional. Only dropping color entirely removes the parser.

However dropping color also removes sanitization, as the two share a code path, so untrusted input then reaches the reader's terminal verbatim:

Note: deactivating the build-time feature color is not a mitigation as that
removes all ANSI escape code stripping from env_logger.

Neither configuration avoids both. The coupling isn't required though: without color there is no styling emitted, so nothing needs parsing, only payload bytes need neutralizing.

Proposal

Escape C0 and DEL as \xNN when color is off, sparing \n and \t.

• 319 ns/record measured, so sanitizing costs ~17 ns over the unsafe build today
• color path untouched, no behavior change for anyone using it
• differs from the strip it replaces in both directions:
  • stricter on \r, VT and FF, which anstream passes through
  • more permissive on raw C1 and stray continuation bytes, which anstream drops (matching it there needs full UTF-8 validation — ~20 lines, free for ASCII records, ~+40 ns/record for records with legitimate non-ASCII)

Start in src/writer/mod.rs:134 and trace AutoStream's color-disabled path through the sanitization and anstyle-parse handling. Reproduce the stated benchmark, then verify that C0 and DEL bytes are neutralized while newline and tab remain unchanged, the color path is unaffected, and legitimate non-ASCII input is handled according to the chosen behavior.