Three cases (pipe-in-model, ANSI-in-model, pipe-in-category) reproduce the audit's SwiftBar directive-separator attack. Tests fail against current menubar.ts -- Task 13 will close with an allowlist sanitizer.