fix: Sanitize terminal hyperlinks in plain output

[jack-arturo]

Summary

• Replaces the no-control-regex-triggering hyperlink label sanitizer with shared char-code control-character encoding.
• Keeps theme.link plain for no-color/non-TTY output so CI and redirected stdout do not receive OSC 8 control sequences.
• Adds regression coverage for plain/color hyperlink behavior plus invalid and non-http URL fallback text.

Verification

• npm run lint exits 0 with 156 existing warnings and no errors.
• npm test -- src/cli/ui/ui.test.ts --reporter=dot passes 1 file / 25 tests.
• git diff --check

Review

• Independent review found missing regression coverage; fixed.
• Independent review found plain-mode OSC 8 leakage; fixed.
• Independent review found invalid/non-http URL fallback still returned raw control text; fixed.
• Final re-review returned no findings.

Stacked on top of feat/installer-visual-flair because that feature branch already has PR #157 open.