Avoid allocations when sanitizing TUI user text (#38214)

## Why

Sanitizing user messages and pasted text always allocated a new string, even
when the input contained no terminal control characters.

## What changed

- Return a `Cow<str>` from `sanitize_user_text` so clean borrowed input remains
  borrowed.
- Reuse owned input buffers when sanitization leaves the text intact or only
  removes content at the edges.
- Update transcript rendering, history cells, and paste handling to consume the
  borrowed-or-owned result without unnecessary cloning.

## Testing

Add sanitizer coverage for clean text, control sequences, Unicode control
characters, incomplete escape sequences, buffer reuse, and multi-fragment
output.

GitOrigin-RevId: 9e39cbc0d83c5791941b37a7eb4bb918c1a05f68

codex-rs/tui/src/bottom_pane/chat_composer.rs

@@ -1131,15 +1131,17 @@ impl ChatComposer {
     /// the next user Enter key, then syncs popup state.
     pub fn handle_paste(&mut self, pasted: String) -> bool {
         let pasted = pasted.replace("\r\n", "\n").replace('\r', "\n");
-        let pasted = sanitize_user_text(&pasted);
+        let pasted = sanitize_user_text(pasted.into());
         let char_count = pasted.chars().count();
         if char_count > LARGE_PASTE_CHAR_THRESHOLD {
             let placeholder = self.next_large_paste_placeholder(char_count);
             self.draft.textarea.insert_element(&placeholder);
-            self.draft.pending_pastes.push((placeholder, pasted));
+            self.draft
+                .pending_pastes
+                .push((placeholder, pasted.into_owned()));
         } else if char_count > 1
             && self.image_paste_enabled()
-            && self.handle_paste_image_path(pasted.clone())
+            && self.handle_paste_image_path(&pasted)
         {
             self.draft.textarea.insert_str(" ");
         } else {
@@ -1150,8 +1152,8 @@ impl ChatComposer {
         true
     }
 
-    pub fn handle_paste_image_path(&mut self, pasted: String) -> bool {
-        let Some(path_buf) = normalize_pasted_path(&pasted) else {
+    pub fn handle_paste_image_path(&mut self, pasted: &str) -> bool {
+        let Some(path_buf) = normalize_pasted_path(pasted) else {
             return false;
         };