🛡️ Sentinel: [CRITICAL] Fix YAML injection in template string interpolations

[Jandir]

🚨 Severity: CRITICAL
💡 Vulnerability: The yaml_safe function used in PEP-750 template string interpolations only escaped double quotes ("). This left the application vulnerable to YAML injection because an attacker could use unescaped backslashes (\) to escape an existing quote or use newlines (\n) and carriage returns (\r) to break out of the string context and inject arbitrary YAML keys.
🎯 Impact: If exploited, an attacker could manipulate the YAML document structure generated during the ETL pipeline, potentially causing data corruption, unintended overwriting of metadata fields, or code execution if the YAML is later parsed unsafely by another system.
🔧 Fix: Modified yaml_safe in escriba.py to properly escape backslashes, double quotes, newlines, and carriage returns. The backslash replacement is done first to prevent double-escaping.
✅ Verification: Ensure the test suite passes (ignoring tests/test_escriba.py due to Python 3.12 syntax limitations on PEP-750). The new assertions in tests/test_escriba.py correctly validate the escaping of backslashes, newlines, and carriage returns.

---

PR created automatically by Jules for task 1898499314371890166 started by @Jandir

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.