fix: sanitize tool-call syntax in team, member, and task fields

[xyzzing]

Summary

The agent_teams_create handler and parseAgentTeamsCreateArgs only called .trim() on incoming fields. When the model emitted a malformed argument blob like {"name": "sinter-phase2</parameter><parameter=description>..."}, the plugin persisted and rendered the entire string as the team name, member name, member role, task subject, and task description.

Reproduction

1. Enable AgentTeams
2. Create a team whose tool call has a name containing <parameter=...> syntax
3. Observe the ActivityPanel, conversation card, and DAG labels render the raw blob

Fix

Add src/sanitize.ts with sanitizeField(value, param?):

• if <parameter=param>VALUE is present, return VALUE
• otherwise truncate at the first <
• return null/undefined unchanged

Apply at every handler (src/tools.ts) and every render site (src/client/*).

Tests

• Unit tests for sanitizeField (parameter match, cut-at-<, clean string, null/undefined, non-string primitives)
• Regression test on the malformed blob in parseAgentTeamsCreateArgs

Compatibility

No schema change. Old sessions with dirty persisted state are repaired by the render-site guards, so no migration is required.