fix(test): emit well-formed JUnit XML for replay results

[PLASMA-FR]

Summary

Complete the existing JUnit reporting workflow from #936 and #1550. Replay results containing ESC, NUL or U+FFFF currently produce XML that standard parsers reject; literal attribute whitespace also changes during parsing.

The JUnit presentation boundary now replaces XML 1.0-forbidden characters with U+FFFD and preserves legal whitespace using character references. Original JSON/custom-reporter values and suite exit codes stay intact. Five files cover serialization, regressions, CLI help, documentation and changelog.

agent-device test ./flows --reporter junit:./junit.xml --json

Validation

Tested 76645521f9b977b837c6b6aa4dded73c9c7a27f0 with Node 24.13.1 and pnpm 11.17.0.

• Nine regression cases failed on unchanged main; a planted whitespace-encoding omission also fails.
• 101 focused reporter/CLI tests and 12 command-doc tests pass.
• The built CLI exercises both reporter spellings through a local HTTP fixture. Python ElementTree rejects/normalizes the baseline reports and reads all four fixed reports exactly; original JSON and exit code 1 are preserved.
• pnpm build passes. AGENT_DEVICE_VITEST_MAX_WORKERS=1 pnpm check:affected --run passes all runnable gates: 2,783 tests / 381 files plus format, lint, types, layering, Fallow and build.

This is local report serialization; no device behavior changes. GitHub CI is pending.

[thymikee]

No code findings at 7664552. The XML replacement and whitespace escaping stay at the JUnit boundary, with regression coverage for round-tripping and unchanged suite values. The iOS smoke failure cannot find automation-longpress after scrolling and appears unrelated to report serialization; ready for human review.