docs: use JSON.stringify for codegen escaping in the Task 12 plan

The plan's union helper hand-rolled escaping for backslash and double quote
only. Role names reach the emitter through the raw mergeCatalogs path, which
does not apply the registry's permission-id regex, so a value containing a
newline was emitted verbatim and the generated file failed to compile with
TS1002 Unterminated string literal.

Caught by the Task 12 implementer actually running tsc over the generated
output rather than eyeballing the string.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/plans/2026-08-04-authz-permissions-implementation.md

@@ -2967,10 +2967,14 @@ import type { AuthzCatalog } from "./types.ts";
 
 function union(values: string[]): string {
   if (!values.length) return "never";
+  // JSON.stringify, not hand-rolled escaping: role names reach this via the
+  // raw mergeCatalogs path without the registry's id validation, so a value
+  // may contain a newline, which manual quote/backslash escaping would emit
+  // as an unterminated string literal.
   return values
     .slice()
     .sort()
-    .map((value) => `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`)
+    .map((value) => JSON.stringify(value))
     .join(" | ");
 }