perf: eliminate double allocation in render_error_sanitized

[dean0x]

Location: crates/mds-cli/src/output.rs:495

What: format!("{report:?}") materializes the entire rendered frame into a String, then sanitize_control_chars allocates a second full copy. This is two full-frame allocations for one I/O operation.

Why deferred: Works correctly as-is; the change is a performance optimization not a bug fix. Lower priority than the security hardening.

Source review: .devflow/docs/reviews/fix-esc-injection-176/2026-07-25_1625 (rust-11, suggestion with 68% confidence)

Acceptance Criteria:

• Profile directory-mode lint runs to determine if single-pass is worth the complexity
• Consider implementing a sanitizing fmt::Write adapter for miette rendering
• Verify no regression in output correctness
• Benchmark before and after on realistic file sets

Note: Only worth the implementation effort if large directory-mode lint runs show up in profiles. The current form is clearly correct and easily testable. See T-10 test strategy for coverage requirements.