tech-debt: Harden CLI/NAPI boundaries with escaping and injection tests

[dean0x]

Problem

CLI and NAPI boundaries lack explicit coverage for:

1. CLI boundary — JSON special-char escaping test

   • Location: crates/mds-cli/tests/
   • Core escaping is tested at serde layer; this pins round-trip at CLI boundary

2. NAPI boundary — role injection and validation test

   • Location: crates/mds-napi/__test__/
   • Vars marshaling via parse_compile_opts with dynamic role evaluation needs explicit coverage

Root Cause

Core escaping and role validation are covered by evaluator unit tests + napi spec, but explicit boundary tests for the full I/O stack are missing.

Solution

Add targeted integration tests:

• CLI: test JSON output with special characters (quotes, newlines, Unicode) round-tripping through stdout capture
• NAPI: test role injection via vars with dynamic evaluation at binding layer

Priority

Low — Core functionality is serde-tested and verified. Nice-to-have hardening pass.

Related

• Implements pattern from cycle-3 deferred batch-B
• See also feat: structured JSON output via @message blocks and compileMessages() (#56) #87 resolution summary (B10)