PTY malformed UTF-16

Trap: validating JavaScript string length, NUL absence, and encoded byte limits looks sufficient, but UTF-8 encoding replaces lone UTF-16 surrogates, so approved text can differ from transported and executed bytes. Fix: require String.prototype.isWellFormed() for commands, every argument, and decoded writes before permission checks, byte limits, canonical resource construction, transport encoding, or execution.