fix(bundle): escape catalog metadata in discovery output

[marcelsafin]

Description

Bundle catalog and manifest values were rendered through console.print with
Rich markup enabled. Bracketed IDs, names, roles, descriptions, authors,
licenses, source IDs, requirements, integration IDs, component labels, and
overlap descriptions were interpreted as styling instead of literal text.

This escapes every untrusted value rendered by bundle search and bundle info
while preserving trusted badges, headings, policies, and JSON output.

Regression tests use a real local catalog plus a parsed manifest, with distinct
Rich tags on catalog, manifest, component, and overlap fields.

Testing

• Tested locally with uv run specify --help
• Ran existing tests with uv sync && uv run pytest
• Tested with a sample project (if applicable)

Full suite: 5424 passed, 172 skipped.

AI Disclosure

• I did not use AI assistance for this contribution
• I did use AI assistance (describe below)

GitHub Copilot (GPT-5.6 Sol) autonomously identified, implemented, tested, and
self-reviewed this change on behalf of @marcelsafin.

[Copilot]

Pull request overview

Escapes untrusted Rich markup in human-readable bundle discovery output while preserving trusted formatting and JSON output.

Changes:

• Escapes catalog, manifest, component, and overlap values in bundle search and bundle info.
• Adds regression tests using markup-bearing metadata.
• One unescaped catalog-supplied fallback count remains.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
src/specify_cli/commands/bundle/__init__.py	Escapes dynamic Rich output values.
tests/contract/test_bundle_cli.py	Tests literal rendering of markup-bearing values.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.