refactor(io): take &str in ConsoleIO write and sanitize

doWrite, doOverwrite and sanitize accept PHP's string|list<string>, which
this port modelled as PhpMixed. Every call site inside ConsoleIO passes a
single string, so take &str and return String instead, dropping the
(array) casts and the to_string_list helper.

Auditor is the only caller that passed a list: it builds table rows, whose
cells must stay separate, so it now sanitizes each cell. select() likewise
sanitizes each choice while projecting them into the keyed form.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

1 files changed, 11 insertions, 15 deletions

diff --git a/crates/shirabe/src/advisory/auditor.rs b/crates/shirabe/src/advisory/auditor.rs
index 40a8d53c..c85871fc 100644
--- a/crates/shirabe/src/advisory/auditor.rs
+++ b/crates/shirabe/src/advisory/auditor.rs
@@ -18,6 +18,7 @@ use shirabe_php_shim::{
     array_keys, array_reduce, get_class,
 };
 use shirabe_symfony_console::formatter::OutputFormatter;
+use shirabe_symfony_console::helper::Cell;
 
 /// Shape of the `--format=json` audit output.
 #[derive(serde::Serialize)]
@@ -488,11 +489,10 @@ impl Auditor {
                     .set_horizontal(true)
                     .set_headers(headers.into_iter().map(|h| h.into()).collect());
                 table.add_row(
-                    ConsoleIO::sanitize(
-                        PhpMixed::List(row.into_iter().map(PhpMixed::String).collect()),
-                        false,
-                    )
-                    .into(),
+                    row.iter()
+                        .map(|cell| ConsoleIO::sanitize(cell, false).into())
+                        .collect::<Vec<Cell>>()
+                        .into(),
                 );
                 table
                     .set_column_width(1, 80)
@@ -614,16 +614,12 @@ impl Auditor {
             } else {
                 "none".to_string()
             };
-            table.add_row(
-                ConsoleIO::sanitize(
-                    PhpMixed::List(vec![
-                        PhpMixed::String(self.get_package_name_with_link(pkg.clone().into())),
-                        PhpMixed::String(replacement),
-                    ]),
-                    false,
-                )
-                .into(),
-            );
+            let row: Vec<Cell> = vec![
+                ConsoleIO::sanitize(&self.get_package_name_with_link(pkg.clone().into()), false)
+                    .into(),
+                ConsoleIO::sanitize(&replacement, false).into(),
+            ];
+            table.add_row(row.into());
         }
 
         table.render();