End DCS/OSC strings at any ESC, default the external terminal to Terminal.app

A string with no ST swallowed every later sequence, RIS included, and
Clear Screen could not recover the tab. Any ESC now ends it, as in xterm,
and the sequence it starts is dispatched. The shipped setting needed Kitty.

Also: REP, SCOSC/SCORC, DECOM-relative CPR, `:` subparams and more DECRQM
modes answered; new rows inserted in one edit; controls stripped from
pastes; wide-char mouse columns.

tests/test_commands.py

@@ -4,7 +4,7 @@ import _bootstrap  # sets sys.path for the imports below
 from _bootstrap import FakeProcess
 
 import sublime
-from vterm.commands import VtermPasteSelectionCommand, VtermSelectThemeCommand, selection_text
+from vterm.commands import VtermPasteSelectionCommand, VtermPasteTextCommand, VtermSelectThemeCommand, selection_text
 from vterm.emulator import VtScreen
 from vterm.render import CONTINUATION
 from vterm.scheme import get_scheme_manager
@@ -245,3 +245,17 @@ view = FakeView("abcdef", [sublime.Region(2, 2)])
 assert paste(view) == [], view.commands
 
 print("selection tests passed (sentinel stripping, paste, empty no-op)")
+
+
+# a paste is a trust boundary: C0 controls bar tab/LF/CR go, so a pasted
+# ESC[201~ cannot close the bracket and type the rest into the app
+terminal = fake_terminal("default")
+terminal.process = terminal.screen._process
+terminal.screen.set_mode(2004, private=True)
+terminal.view.run_command = lambda name, args=None: None
+command = VtermPasteTextCommand.__new__(VtermPasteTextCommand)
+command.view = terminal.view
+command.run(None, "a\x1b[201~b\x00\tc\nd")
+assert terminal.process.written == "\x1b[200~a[201~b\tc\rd\x1b[201~", repr(terminal.process.written)
+
+print("paste tests passed (controls stripped, bracket kept whole)")