fix(near): sanitize untrusted strings on the intents render path

[shahan-khatchadourian-anchorage]

Stacked on #439.

Every caller-controlled string the intents renderer puts on the signing screen goes through charset_safe. The core charset validator permits \n as the wallet's documented multi-line separator (validate_charset, and its own comment says attacker-controlled strings must be sanitized at the insertion site), so an unfiltered memo or msg renders as extra apparent confirmed fields the parser never authored:

   ├─ To: 608fe1e7...
   ├─ Amount: 1 (unresolved nep141:sol.omft.near)
   └─ Message: innocent
To: alice.near
Amount: 0.001 SOL

The sibling borsh transaction path already filters at each insertion site. charset_safe moves to fmt.rs so both NEAR paths share one definition rather than the intents path reaching across into actions.rs.

Sinks covered

Field	Where
memo	token_diff, transfer, and all three withdraws
msg	transfer's notification, the withdraws, auth_call
token_id	nft_withdraw (non_fungible_token::TokenId = String)
token_ids	mt_withdraw (defuse_nep245::TokenId = String)
asset id	the unresolved-amount fallback and the unverified-token-metadata diagnostic
every diagnostic message	filtered inside diagnostic() itself

referral is exempt and stays unfiltered: it is an AccountId, whose own charset rules already exclude everything the filter strips, so filtering it would be dead code.

TokenId is not exempt despite its account-id-shaped prefix — its FromStr parses only the contract half as an AccountId and takes the remainder verbatim into a plain String, which Display round-trips. Verified against the pinned defuse-core rev 6dad94c.

Two details worth a reviewer's eye

Resolution runs on the raw asset id; only the rendered form is filtered. Filtering first would let a crafted id collapse onto a seeded one — nep141:wrap\u{7f}.near -> nep141:wrap.near — and borrow that token's symbol and decimals. Pinned by asset_id_resolves_on_its_raw_form_not_its_sanitized_form.

Filtering inside diagnostic() rather than at each call site. Every rule on this path quotes untrusted input — an asset id, a serde_json::Error that interpolates the offending value with {} — so the choke point is what makes a newly added rule safe by construction.

Behavior changes

• mt_withdraw renders its memo. It carries the field and silently dropped it, while ft_withdraw and nft_withdraw both rendered theirs. Folding memo into push_withdraw_call_details alongside msg and storage_deposit closes it by construction.
• Filtering happens before the emptiness test, so an all-non-ASCII memo drops out instead of rendering as a blank Memo line. Applied at all three memo sites.
• Filtering strips rather than rejects: a legitimate memo with an accented character or emoji loses those characters instead of failing the whole parse. This matches the borsh path and keeps a non-ASCII memo from denying the signer their transaction.

Testing

Tests assert exact output rather than the absence of a newline, so a filter that dropped only \n while passing \t, \r, control bytes or backslashes would still fail. charset_safe gains direct coverage in fmt.rs including the bidi-override and all-non-ASCII cases.

192 tests pass with default features, 176 with --no-default-features (the Warning-text build), clippy clean, full make test green.

🤖 Generated with Claude Code