fix(cli): stop parsing runtime data as rich console markup

[Jason Robert (jrob5756)]

Closes#406.

The bug

Rich parses [...] in a plain str as console markup, and Conductor interpolated runtime data — workflow names, agent names, plugin metadata read out of git-cloned repos, str(e), gate payloads — straight into those strings. A bracketed token is a tag when its first character is lowercase, #, / or @, so the behaviour splits three ways and only one is loud:

first char	example	result
digit / uppercase	[0], [KPI_3]	renders literally
lowercase, #, @	[task1], [#42]	silently deleted
/	[/bold], [/etc/x]	MarkupError, out of the print call

The quiet half matters more: a listing that drops part of a name looks like it worked. style= does not disable parsing.

What was actually broken

Four sites, all reproduced against main before the fix:

1. conductor validate crashed on workflow.name: "probe [/bold] name", and printed probe name for [dim].

2. Every for-each iteration's verbose panel read the same. The engine qualifies a member's name as <agent>[<key>] so interleaved output can be attributed to one iteration; key_by: keys are agent-derived, so:

   key='0' -> Prompt for 'review[0]' ok
   key='task1' -> Prompt for 'review' IDENTITY ERASED
   key='docs/a.md' -> Prompt for 'review' IDENTITY ERASED
   key='/etc/x' -> MarkupError RUN DIES
   

   This needed no flags — verbose and full mode both default on. The comment directly above it claimed "title is conductor-controlled, so it keeps its styling", which was false.

3. conductor status (feat(cli): add a read-only \conductor status\ command #389) corrupted its listing — the name a user reads to pick a port for conductor stop.

4. gates/dialog.py built a Panel title from the same for-each qualified name. Not in the issue; found while working.

This is the third occurrence. #382 was the original; #387 fixed cli/run.py thoroughly and still left title= in the very function it changed; #389 and #398 then reintroduced the pattern next door, in files #387 never touched. #398 also made these strings third-party rather than the author's own YAML.

Approach

A per-site escape pass across ~450 literals demonstrably does not hold, so the default is inverted instead.

New leaf module src/conductor/console.py — top-level rather than under cli/, because gates/ and providers/ need it and must not import from cli/:

• make_console() locks markup=False. A plain string is now literal unless it asks to be styled, which fixes 119 sites with zero code churn and covers plain prints, Panel bodies, Table cells/headers/titles/captions and Rule titles. It rejects a markup= kwarg rather than allowing an override.
• styled("<template>", value) parses conductor's own template but inserts values verbatim and byte-exact. It replaces each field with a length-matched filler run, parses once, then substitutes by offset — matching the width is what keeps the parsed template's spans valid, so nested styling around a placeholder ([bold][red]{}[/red][/bold]) is correct. Reading spans[0].style instead would collapse it. A value that is already a Text splices in with its own spans re-anchored.
• join(sep, parts) — Text.join requires every part to already be a Text, but the common shape here is a content_lines list mixing styled fragments with plain runtime values.

Panel(title=)/(subtitle=) and Prompt/Confirm/IntPrompt are handled separately. Rich calls Text.from_markup on those unconditionally (rich/panel.py:113,129, rich/prompt.py:67), so markup=False never reaches them. Measured, not assumed — and it is exactly the trap that left #387 incomplete one line from the code it changed.

rich.markup.escape is dropped everywhere. It is not byte-exact: the parser treats \[ as an escaped bracket, so an ordinary regex \[0-9\]+ renders as [0-9\]+ whether escaped first or not.

Typer's help=/epilog= are deliberately left alone — Typer renders those through its own console.

Rendering is byte-identical to main

Verified across ten commands, ANSI codes included. That took one extra step worth calling out: rich applies its ReprHighlighter to a plain str but not to a Text, so the conversion would otherwise have silently de-coloured every number, path and quoted value across the whole CLI — a cosmetic regression bundled into a safety fix. _MarkupFreeConsole.print re-applies the highlighter in rich's own order (highlight first, conductor's spans copied on top).

Keeping it fixed

tests/test_cli/test_markup_guards.py reads src/conductor with ast and fails with file:line:

• A — every Console goes through make_console (or explicitly passes markup=False)
• B — no interpolated string to a Panel title/subtitle or a Prompt
• C — no f-string to Text.from_markup
• D — no bare markup literal at a print/cell sink (this is what makes the conversion verifiable rather than eyeballed)
• E — no Rich Text through the builtinprint, which renders its plain form and drops anything rich parsed as a tag

Each rule has negative controls, because a source scan that quietly matches nothing reports "all clear" forever. _safe_text_names does small intra-function dataflow so a genuinely Text-typed local is not pushed onto an allowlist. I verified the guards fail when the original bug is reintroduced.

The convention is written up in AGENTS.md (new Console Output section under Code Style, plus an architecture entry), not only in code comments.

Review notes

A code review of this branch caught two regressions I had introduced, both now fixed and both covered by new tests:

• the codemod wrapped a stderr log label in Text.from_markup, and because [workspace-instructions] starts with a lowercase letter rich deleted the prefix. The existing test passed, because it asserted on a substring after it. Rule E exists because of this.
• f"{mark} ..." flattened a Text and dropped the ✓/⚠ colour from conductor plugin fetch — the marker column on a command CI gates on.

One styled() hardening also came out of it: a NUL in the template is now rejected up front, since it would capture the search that locates each value.

Validation

• make check (ruff lint + format + ty) clean
• 5766 tests pass, 47 skipped (+88 new)
• 44 example workflows validate
• All four repros verified fixed; conversion audit at zero
• Rendered output byte-identical to main across ten commands