fix(renderer): sanitize embedded newlines in Output.add_line - #447

Problem: when the LLM emits question options (or any other
server-supplied text) whose label or description contains a literal
newline, format_options inserts the raw string as a single line in
the formatted output. nvim_buf_set_lines then rejects the line
with 'replacement string item contains newlines' and the whole
flush errors out, dropping the part from the rendered buffer and
leaving an apparently-broken dialog (only the title text visible).

Solution: replace any embedded \r\n, \n, or \r with a single
space at the Output layer. This is the natural defensive boundary:
every line that flows to nvim_buf_set_lines goes through add_line
or add_lines, so sanitizing there covers every renderer call site
(question options, permission titles, MCP tool output, etc.) at
once without scattering special-case handling.

Use question tool call with newline in string param to test if it work well