1. the search text formatter runs every registry field through stripVTControlCharacters except version, which is interpolated as-is.
2. the global output filter only escapes C0/C1 controls and deliberately keeps SGR sequences, so a package whose version carries ANSI escapes lands in the printed results.

Pass version through the same strip() the sibling fields use. Added a regression test that a crafted version no longer reaches the terminal.