Potential fix for https://github.com/TeaEntityLab/teaAgent/security/code-scanning/31

Best fix: add a strict terminal allowlist sanitizer immediately before logging, so only safe primitive/structural fields remain and any unknown or potentially sensitive keys/values are redacted. This keeps current functionality (JSON diagnostics output) while making the sink provably safer for static analysis and runtime security.

In teaagent/cli/_handlers/_doctor.py:

1. Add a new helper (near existing sanitizers) that recursively sanitizes output with a conservative policy:
   • redact values for sensitive-looking keys/env names;
   • redact suspicious strings (existing _looks_like_sensitive_string);
   • preserve benign primitives and structure.
2. In print_json, run this strict sanitizer as the final pass before json.dumps.

No new dependencies are required; reuse existing helpers and constants.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.