test.command / test.mise skip the control-line-break validation applied to every other manifest command field

[codeforester]

Summary

_read_test in the manifest parser is the one command-like field that doesn't validate for embedded control/line-break characters.

Details

• cli/python/base_setup/manifest.py:177-203 (_read_test) never calls has_control_line_break().
• Every comparable field does: _read_command_config (:273-296), _read_demo (:206-232), _read_activate_sources (:359-377), and build.targets.*.command in manifest_build.py:91-92.

Impact

test.command/test.mise — the command surface used for every project's default basectl test — can silently carry embedded \0/\n/\r bytes that every other manifest command field explicitly rejects, an inconsistency in the manifest's input-validation contract.

Suggested fix

Apply has_control_line_break() to test.command and test.mise in _read_test, matching the other command-like fields.