Adversarial input validation for agent-generated commands

Summary

AI agents make different mistakes than humans — they may generate inputs containing path traversal sequences, embedded query parameters, URL encoding, or control characters. The CLI should validate and reject malformed inputs at the CLI boundary before they reach the Kubernetes API.

Proposal

• Implement path canonicalization and sandbox validation for file arguments
• Reject resource IDs containing query params (?, #) or URL encoding (%)
• Filter non-printable ASCII control characters from all inputs
• Add --sanitize flag for defensive filtering of API responses (prompt injection defense)

Acceptance Criteria

• File path arguments are canonicalized and validated against path traversal
• Resource names/IDs reject ?, #, %-encoded characters
• Control characters (non-printable ASCII) stripped from inputs
• --sanitize flag available to sanitize API response content

Context

Part of #2849 — making tkn agent-friendly.

/kind feature

No files or tests are named; start by tracing the CLI argument boundary and the path from parsed inputs to the Kubernetes API, then locate API response handling for the proposed --sanitize flag. Done means the listed path, resource-ID, control-character, and response-sanitization acceptance criteria are covered without allowing malformed input through.