Result-contract helpers (PRD §9).

sanitize/1 converts a run result (or any engine term) into a JSON-serializable map: string keys, ISO-8601 datetimes, atoms as strings, tuples/pids/refs inspected. Used by the MCP submit_approval_script tool to return the result as structured content, and useful for any host that needs to ship results over a wire.