docs: widen logSafe to Unicode line separators in the Task 5 plan snippet

The re-review confirmed the log-injection fix works for C0 and DEL, but
U+0085 (NEL) and U+2028/U+2029 pass through. Those are line terminators to
some log shippers and to JavaScript's own lexical grammar, so they can still
split a record downstream.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/plans/2026-08-04-authz-permissions-implementation.md

@@ -1093,7 +1093,11 @@ function logSafe(value: string): string {
   let out = "";
   for (const character of value) {
     const code = character.codePointAt(0)!;
-    out += code < 0x20 || code === 0x7f ? " " : character;
+    // C0 + DEL, plus NEL and the Unicode line/paragraph separators, which some
+    // log shippers and JSON consumers also treat as line terminators.
+    const isLineBreaking =
+      code < 0x20 || code === 0x7f || code === 0x85 || code === 0x2028 || code === 0x2029;
+    out += isLineBreaking ? " " : character;
   }
   return out;
 }