test: cover safeUrl and sanitizeUrl script-scheme guards

[readyagentsdev]

Closes #342.

Adds tests/url-scheme-guards.test.js: table-driven tests for safeUrl (src/safe-url.js) and sanitizeUrl (src/shared/sanitize-url.js). Tests only, no source changes.

Covered

• javascript:, data:, vbscript: in mixed casing and with leading whitespace fall back (default '#' and a custom fallback for safeUrl)
• protocol-relative //host is rejected
• allowed shapes pass through: http(s)://, root-relative /path, #anchor
• non-strings and blank input
• a small block pinning the current intentional differences between the two (mailto:, ./ / ../, trimming, and https:example.com without slashes, which only safeUrl accepts)

Not pinned, worth a look: both functions currently accept /\evil.com. Browsers normalise a leading /\ to //, so as an href this navigates to evil.com. I left it out of the tests rather than locking in either behaviour, so you can decide whether it should be rejected.

npx vitest run tests/url-scheme-guards.test.js: 102 passed. prettier --check clean.