Stop building terminal debug messages on hot paths

[DROOdotFOO]

Summary

Makes disabled debug logging cheap without changing terminal mode semantics, and prevents control payloads from reaching logs as raw terminal bytes.

• Use Logger macros on hot terminal paths so interpolation is skipped below the active level.
• Preserve lazy zero-arity messages through Raxol.Core.Runtime.Log helpers.
• Hoist risky dereferences outside lazy log expressions so disabling debug cannot hide existing errors.
• Keep ModeManager clause behavior intact.
• Configure Logger itself at :info in production; TERMINAL_LOG_LEVEL uses an explicit validated allowlist.
• Redact DCS/APC payloads and OSC payloads; escape remaining attacker-controlled command fields.
• Never log OSC 52 clipboard content.

Manual testing

• Core logging tests: 3 passed
• Terminal DCS/OSC/screen/mode tests: 64 passed
• Valid runtime logger level resolves to the expected atom
• Invalid runtime logger level raises with the rejected value and valid choices
• mix format --check-formatted

[DROOdotFOO]

Independent re-verification of the suite claim, by the reviewer rather than the branch author:

mix test in packages/raxol_terminal on this branch is 2403/2404 with 1 failure, not 0 failures. The failure is Raxol.Terminal.ANSI.ExtendedSequencesTest "process_unicode/2 handles valid Unicode characters", and it is pre-existing and load/order dependent, not caused by this change:

# this branch, full suite, seed 0
Result: 2403/2404 passed (14/14 doctests, 2389/2390 tests), 46 excluded
Failed: 1 test -- ExtendedSequencesTest "process_unicode/2 handles valid Unicode characters"

# clean master worktree (raxol_terminal untouched), full suite, seed 0
Result: 2402/2403 passed (14/14 doctests, 2388/2389 tests), 46 excluded
Failed: 1 test -- the same test

# the same file in isolation, both trees
Result: 14 passed

Same failure, same seed, with and without the branch; it passes in isolation on both trees. So the net effect of this branch on the package is +1 test (the new causality test) and no change in failures. The "0 failures" line in the body was a single lucky run under lighter load.

[github-actions]

Unified Regression Test Results

Workflow: Unified Regression Testing
Event: pull_request
SHA: 013ea02

Performance Results

Found 1 performance result(s)

Memory Results

Found 3 memory result(s)

Targets

• Parser: <3μs average
• Render: <1ms average
• Memory: <3MB per session

[DROOdotFOO]

Adversarial Review: PR #1039 (mode-log-lazy)

Three personas ran independently over this diff (Saboteur, New Hire, Security Auditor), each with its own worktree probes. Severity promoted one level where two or more personas landed on the same defect.

CRITICAL

• The paste DoS is relocated, not closed. [Saboteur + Security Auditor + New Hire -> promoted from HIGH] Eight eager Log.debug("...#{inspect(...)}") sites survive on the DCS/sixel path, in files this PR edited and the body claims to have audited: dcs_handler.ex:119,176-178,209-211, executor.ex:260-262, sixel_parser.ex:253. Measured post-fix at :emergency: DCS passthrough 48-76 us/input-byte (3-5x plain), ESC P q !9~ 198-227 us/input-byte (13-15x plain) — against the 58 us/byte in Mode WRITE path is a paste DoS #1031 this PR exists to fix, and against its own "within ~2x of plain text" acceptance. An A/B build with only those eight sites lazified drops DCS passthrough to 0.71-1.84 us/byte. cat of a crafted sixel file is the same CPU-exhaustion primitive with a different escape sequence. The PR body also lists dcs_handler's inspect(pixel_buffer)/inspect(palette) under "deleted rather than deferred"; they are still there at :176-178.
• Log.debug/2 with a zero-arity fun raises. [New Hire + Security Auditor -> promoted from HIGH] log/3 builds "#{msg} | Context: #{inspect(context)}" (packages/raxol_core/lib/raxol/core/runtime/log.ex:85-90), so the new convention breaks the moment anyone adds a context map to one of the ~100 converted sites. Verified: Log.debug(fn -> "x" end, %{mode: :decckm}) -> Protocol.UndefinedError, String.Chars not implemented for Function. That raises before any level check, i.e. in production at :emergency, on the terminal write path (control_codes.ex:222-226 runs per CR byte).

HIGH

• The rule is written down nowhere a contributor will hit it. [New Hire + Security Auditor] The only statement of "interpolate eagerly = per-byte cost, pass a fun instead" is a five-line comment inside mode_manager_test.exs:141-145. Log.debug/1 has no @doc and no @spec; the module's Usage block shows only strings; CLAUDE.md has no logging section. Mode WRITE path is a paste DoS #1031 named this as the trap.
• Same primitive at the DEFAULT production level. [Security Auditor] executor.ex:203 and neighbours log per-byte at warning, which config/prod.exs:19 leaves enabled, so the eager build happens in prod regardless of debug.

MEDIUM

• The new test filters built messages by the probe mode name and only covers the failure path, so it cannot see a success-path regression [Saboteur + New Hire].
• Un-lazified twins of converted sites (cursor/callbacks.ex:15 and others) — inconsistency with no stated rule [New Hire].
• The probe script is not committed, so the PR's numbers cannot be re-run [New Hire].

LOW

• async: true test enables a VM-global :erlang.trace_pattern on Logger.bare_log/2, slowing every concurrently running test [Saboteur + Security Auditor].

Cross-persona overlaps

Issue	Personas	Promotion
DCS/sixel path still eager	Saboteur, Security Auditor, New Hire	HIGH -> CRITICAL
Log.debug/2 + fun raises	New Hire, Security Auditor	HIGH -> CRITICAL
Rule undocumented	New Hire, Security Auditor	MEDIUM -> HIGH
Test's filter is too narrow	Saboteur, New Hire	MEDIUM (both at MEDIUM)

Verdict: BLOCK

Before merge: lazify or delete the eight DCS/sixel sites and re-measure that class the way the PR measured CSI h/l; teach log/3 about funs (or add Log.debug_lazy/1) and cover it with a test; write the rule where a contributor will find it; widen the regression test to the success path.